EUVD-2026-36394
GHSA-xw5h-cmh3-8j6j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed CXF SOAP/XML endpoint
-
DeliveryCraft XML payload with external entity DOCTYPE
-
ExploitSubmit to vulnerable EndpointReferenceUtils/W3CMultiSchemaFactory path
-
ExecutionSAX parser resolves entity over network
-
ImpactExfiltrate internal data via OOB channel
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable code paths are in EndpointReferenceUtils and W3CMultiSchemaFactory; an exploitable deployment must process attacker-controlled XML through one of these classes, which typically occurs on CXF-based SOAP/WS-Addressing endpoints that accept external XML or W3C XML Schema documents. The server must also have outbound network reachability (or local file read paths) for the OOB entity resolution to return useful data - fully air-gapped or strictly egress-filtered hosts substantially limit impact. Per CVSS PR:N/UI:N, no authentication or user interaction is required at the protocol level if the vulnerable endpoint is exposed, but realistic exploitation is bounded by whether the application actually surfaces these utility classes on an untrusted input path and whether the affected CXF version (anything before 4.1.7, or 4.2.0-4.2.1) is in use. |
| Impact | The signals here conflict significantly and warrant careful interpretation. CVSS 3.1 reports 9.8 critical (AV:N/AC:L/PR:N/UI:N) with full CIA impact, but EPSS sits at only 0.02% (4th percentile), this CVE is NOT on CISA KEV, and no public exploit identified at time of analysis. The OOB nature of the XXE matters: full C:H/I:H/A:H assumes the worst-case where the application echoes parsed content or the attacker can reach sensitive internal services - in many CXF deployments, exploitation requires the application to pass attacker-controlled XML into the affected utility classes, which is not the default for every endpoint. The PR:N rating assumes the vulnerable code path is reachable without authentication, which is deployment-dependent. Net-net, this is a real defect that should be patched on standard cycle, but the low EPSS and absence of KEV listing suggest it is not currently a top-priority emergency for most operators relative to actively-exploited CVEs. |
| Exploit ScenarioDerived | An attacker submits a SOAP request or XML payload containing a crafted DOCTYPE with an external entity referencing an attacker-controlled URL (e.g., http://attacker.example/exfil?d=) to a CXF-based web service endpoint that funnels input through EndpointReferenceUtils or W3CMultiSchemaFactory. The unhardened SAX parser resolves the entity over the network, leaking server-side resources such as internal HTTP responses, cloud metadata endpoints, or file contents back to the attacker out-of-band. No public exploit identified at time of analysis, but XXE exploitation patterns are well-documented and trivially adaptable to any reachable vulnerable code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 15, 2026
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to trigger out-of-band external entity resolution via the EndpointReferenceUtils and W3CMultiSchemaFactory classes, which instantiate SAXParserFactory without JAXP hardening. While CVSS scores this 9.8 critical, EPSS reports only 0.02% exploitation probability, and there is no public exploit identified at time of analysis. Successful exploitation could enable data exfiltration, SSRF, or denial-of-service against applications that process attacker-controlled XML through CXF web services.
Earlier versions of this analysis (2)
XML External Entity (XXE) processing in Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes allows remote attackers to trigger out-of-band external entity resolution against applications that parse attacker-supplied XML through these code paths. The flaw affects Apache CXF versions before 4.1.7 and the 4.2.0-4.2.1 line, and is fixed in 4.1.7 and 4.2.2. No public exploit identified at time of analysis, and EPSS is 0.02% (4th percentile), indicating very low observed exploitation likelihood despite the high CVSS score.
XXE injection in Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes exposes web service endpoints to out-of-band external entity resolution, enabling server-side file disclosure and SSRF against services running cxf-core 4.2.0-4.2.1 or any version before 4.1.7. Both classes construct a SAXParserFactory without enabling JAXP security hardening (e.g., XMLConstants.FEATURE_SECURE_PROCESSING or explicit external entity disablement), leaving the XML parser in a permissive default state. No public exploit has been identified at time of analysis, but XXE classes are well-understood and reliably weaponizable by attackers who can send crafted XML to a CXF-hosted endpoint.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 or 4.1.7, which add the missing JAXP hardening to EndpointReferenceUtils and W3CMultiSchemaFactory. Refer to the Apache CXF project advisory at https://cxf.apache.org/ and the oss-security disclosure at https://seclists.org/oss-sec/2026/q2/885 for upgrade guidance. If immediate upgrade is not possible, compensating controls include restricting outbound network egress from the application server to deny the SSRF/exfiltration channel that OOB XXE relies on (side effect: may break legitimate integrations that fetch remote schemas or DTDs), terminating XML at an upstream gateway/WAF that strips DOCTYPE declarations before they reach CXF (side effect: WAF rules can be bypassed and add latency), and auditing application code that invokes the affected utility classes to ensure attacker-controlled XML is not passed in, or wrapping callers with manually-hardened SAXParserFactory instances (side effect: requires code changes and may be missed in transitive dependencies).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CXF is a widely-used open-source services framework for building SOAP and REST web services in Java, frequently embedded in enterprise middleware. The vulnerability falls under CWE-611 (Improper Restriction of XML External Entity Reference), the classic XXE class. The root cause is that the EndpointReferenceUtils and W3CMultiSchemaFactory classes construct javax.xml.parsers.SAXParserFactory instances without setting the JAXP hardening features such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, or external-general-entities/external-parameter-entities to false. As a result, when the parser processes attacker-supplied XML, it will resolve external DTD/entity references - including network-based URIs - enabling out-of-band exfiltration channels (HTTP/FTP/DNS) and access to internal resources reachable from the server.
Know when Cxf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable XML parser with no auth/UI; OOB XXE typically crosses a security scope to internal systems (S:C), high confidentiality via exfiltration, lower I/A as direct write/DoS is secondary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4Description PRE-NVD
Executive ViewAI
Apache CXF, an open-source web services framework used for XML processing, contains a critical vulnerability that could enable attackers to steal sensitive data or disrupt services through manipulated XML payloads. Despite the severity, no public exploit has been identified, reducing immediate operational risk. Organizations running CXF in production should upgrade to patched versions 4.1.7 or 4.2.2 to eliminate this vulnerability.
Apply vendor patch: Apache CXF 4.1.7 (for 4.1.x branch) or 4.2.2 (for 4.2.x branch).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Exploit-DB