EUVD-2026-36394
GHSA-xw5h-cmh3-8j6j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable XML parser with no auth/UI; OOB XXE typically crosses a security scope to internal systems (S:C), high confidentiality via exfiltration, lower I/A as direct write/DoS is secondary.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to trigger out-of-band external entity resolution via the EndpointReferenceUtils and W3CMultiSchemaFactory classes, which instantiate SAXParserFactory without JAXP hardening. While CVSS scores this 9.8 critical, EPSS reports only 0.02% exploitation probability, and there is no public exploit identified at time of analysis. Successful exploitation could enable data exfiltration, SSRF, or denial-of-service against applications that process attacker-controlled XML through CXF web services.
Technical ContextAI
Apache CXF is a widely-used open-source services framework for building SOAP and REST web services in Java, frequently embedded in enterprise middleware. The vulnerability falls under CWE-611 (Improper Restriction of XML External Entity Reference), the classic XXE class. The root cause is that the EndpointReferenceUtils and W3CMultiSchemaFactory classes construct javax.xml.parsers.SAXParserFactory instances without setting the JAXP hardening features such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, or external-general-entities/external-parameter-entities to false. As a result, when the parser processes attacker-supplied XML, it will resolve external DTD/entity references - including network-based URIs - enabling out-of-band exfiltration channels (HTTP/FTP/DNS) and access to internal resources reachable from the server.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 or 4.1.7, which add the missing JAXP hardening to EndpointReferenceUtils and W3CMultiSchemaFactory. Refer to the Apache CXF project advisory at https://cxf.apache.org/ and the oss-security disclosure at https://seclists.org/oss-sec/2026/q2/885 for upgrade guidance. If immediate upgrade is not possible, compensating controls include restricting outbound network egress from the application server to deny the SSRF/exfiltration channel that OOB XXE relies on (side effect: may break legitimate integrations that fetch remote schemas or DTDs), terminating XML at an upstream gateway/WAF that strips DOCTYPE declarations before they reach CXF (side effect: WAF rules can be bypassed and add latency), and auditing application code that invokes the affected utility classes to ensure attacker-controlled XML is not passed in, or wrapping callers with manually-hardened SAXParserFactory instances (side effect: requires code changes and may be missed in transitive dependencies).
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JN
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today