Connext Professional EUVD-2026-17765

Upgrade to patched RTI Connext Professional versions: 7.7.0 or later for the 7.x branch, or version 7.3.1.1 for organizations on the 7.1-7.3 line. RTI has released patches per vendor advisory at https://www.rti.com/vulnerabilities/#cve-2026-4374. For versions 5.3.x, 6.0.x, and 6.1.x branches where no patch version is specified in available data, contact RTI support directly to obtain appropriate updates or migration guidance. If immediate patching is not feasible, implement these compensating controls: disable XML external entity processing in XML parser configurations used by affected services by setting features like disallow-doctype-decl=true and external-general-entities=false (consult RTI documentation for service-specific configuration paths). Restrict network access to affected service ports using firewall rules, limiting connectivity to only trusted DDS peers (trade-off: breaks cloud connectivity for Cloud Discovery Service). Deploy XML input validation proxies to filter entity declarations before data reaches vulnerable services (adds latency and operational complexity). Disable unused service components among the five affected types to reduce attack surface (may impact observability and routing functionality). Monitor XML processing logs for suspicious entity references or parsing errors as potential exploitation indicators. Note that restricting XML entity processing may break legitimate configurations that rely on external entity references for modular configuration management.