What is the CVSS score of CVE-2026-44618?

CVE-2026-44618 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44618?

Yes, a patch is available for CVE-2026-44618. Update the affected software to the latest version immediately.

Apache CXF CVE-2026-44618

EUVD-2026-31434 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-05-22 apache

GHSA-vmm5-fjgx-2jhp

Apache XXE Red Hat Apache Cxf Apache Software Foundation

5.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable WS-Transfer endpoint requires no auth; XXE yields partial file read only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:35 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

5.3 (None) 5.3 (MEDIUM)

Patch available

May 26, 2026 - 14:16 EUVD

CVE Published

May 22, 2026 - 12:17 cve.org

MEDIUM 5.3

CVE Published

May 22, 2026 - 12:17 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.cxf:cxf-rt-ws-transfer (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.2.0.

DescriptionCVE.org

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

AnalysisAI

XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and internal network probing by unauthenticated remote attackers. The insecure XML parser configuration (CWE-611) affects all 3.x releases before 3.6.11, 4.0.x-4.1.x before 4.1.6, and 4.2.0 before 4.2.1. No public exploit has been identified at time of analysis, EPSS sits at the 8th percentile (0.03%), and CISA SSVC rates exploitation as 'none', placing this squarely in the patch-on-schedule rather than emergency-response category despite the broad network attack vector.

Technical ContextAI

Apache CXF is a Java-based open-source services framework that implements SOAP, WS-*, JAX-WS, and RESTful APIs widely used in enterprise SOA deployments. The vulnerable component is the WS-Transfer module - an implementation of the WS-Transfer OASIS specification for web-service-based resource manipulation using XML messaging. CWE-611 (Improper Restriction of XML External Entity Reference) arises when an XML parser processes attacker-controlled input without disabling DOCTYPE declarations or external entity resolution, typically by failing to set XMLConstants.FEATURE_SECURE_PROCESSING or equivalent JAXP hardening flags. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:* across the three affected version branches. The root cause is a parser configuration gap specific to the WS-Transfer subsystem rather than a global CXF parser regression.

RemediationAI

Upgrade to Apache CXF 4.2.1, 4.1.6, or 3.6.11 as directed by the Apache Software Foundation advisory at https://lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7; these are the vendor-confirmed fixed releases. If immediate patching is not feasible, the most targeted workaround is to disable or remove the WS-Transfer endpoint from the CXF deployment configuration, which eliminates the vulnerable attack surface entirely but removes WS-Transfer functionality for any consuming clients. As a perimeter-level control, deploying an XML-aware WAF or reverse proxy configured to reject or sanitize DOCTYPE declarations in inbound SOAP payloads can reduce exposure, though this approach adds operational overhead and may not cover all XXE vector variations. There is no configuration-only fix for the insecure parser setting without applying the patch; generic XML filtering at the application level is not a substitute for the upstream parser hardening introduced in the fixed versions.