Apache CXF EUVD-2026-31434

Exploitation specifically requires that the Apache CXF deployment has the WS-Transfer module enabled and its endpoint is network-accessible to the attacker - this vulnerability does not affect all CXF endpoints, only WS-Transfer. The CVSS vector (PR:N, AC:L, UI:N) indicates no authentication is required once the endpoint is reachable, and no user interaction is needed. SSVC's 'automatable: no' rating implies that some knowledge of the target's WS-Transfer endpoint address or SOAP message structure is necessary, limiting opportunistic mass exploitation. The confidentiality impact is bounded at C:L, meaning direct file exfiltration is partial rather than unrestricted; the practical read scope depends on the OS user identity running the CXF service and local filesystem permissions. No non-default configuration beyond WS-Transfer endpoint deployment is required to be vulnerable.

The CVSS 3.1 base score of 5.3 (Medium) uses AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating a network-reachable, zero-authentication path with only limited confidentiality impact and no integrity or availability degradation. The SSVC framework partially contradicts the low-complexity CVSS framing by rating automatable as 'no', suggesting successful exploitation requires target-specific knowledge of the WS-Transfer endpoint structure rather than fully scripted mass scanning. EPSS at 0.03% (8th percentile) strongly corroborates no observed real-world exploitation activity. No CISA KEV entry exists. Taken together, the signals consistently point to a theoretically straightforward XXE class vulnerability constrained in practice by the requirement that the WS-Transfer endpoint is deployed and reachable - not a universal CXF exposure. Historical context for CWE-611 in enterprise middleware is worth noting: XXE in SOAP services has enabled SSRF and internal credential harvesting in past incidents, so the C:L ceiling could be optimistic in complex network environments with sensitive internal resources accessible from the CXF host. The absence of any POC and low EPSS make this a scheduled-patch priority rather than an emergency.

An attacker identifies an Apache CXF WS-Transfer endpoint (e.g., via service WSDL discovery or network scanning) and submits a crafted SOAP envelope containing a DOCTYPE declaration referencing an external entity such as file:///etc/passwd or an internal HTTP resource. The CXF XML parser resolves the entity and includes its content in processing; if the content is reflected in a SOAP fault or response body, the attacker reads sensitive server-side files or maps internal network services. No public proof-of-concept has been identified, but the attack pattern is well-documented for CWE-611 class vulnerabilities in SOAP middleware.