What is the CVSS score of EUVD-2026-53856?

EUVD-2026-53856 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache CXF are affected by EUVD-2026-53856?

Apache CXF's WSDL parsing contains an XML External Entity injection vulnerability that could allow attackers to read sensitive files and execute server-side request forgery attacks against systems…. A patch is available.

How to fix or mitigate EUVD-2026-53856?

Within 24 hours, inventory all Apache CXF deployments across production, staging, and development environments to identify affected versions and release branches; concurrently, review and document any external or user-supplied WSDL/XSD sources to assess exposure. Within 7 days, apply vendor-released patches available across CXF's active release branches to all identified systems, prioritizing production first; test patched deployments against existing WSDL configurations to ensure compatibility before full rollout. Within 30 days, complete patching of all remaining systems, perform security testing to validate XXE protections are functional, and establish a process to track and apply future CXF security updates within 7 days of release.

Apache CXF EUVD-2026-53856

| CVE-2026-65432 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-08-06 apache

GHSA-jvhw-7q2c-2r65

Apache XXE Apache Cxf Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AC:H because attacker must control a resource in the WSDL import chain; C:H for arbitrary local file disclosure via XXE; A:L for potential entity-expansion DoS; no integrity impact from read-only XXE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 06, 2026 - 12:01 EUVD

Analysis Generated

Aug 06, 2026 - 11:36 vuln.today

CVE Published

Aug 06, 2026 - 10:26 cve.org

HIGH

DescriptionCVE.org

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

AnalysisAI

XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or XSD documents to bypass XXE protections applied to the top-level WSDL. CXF correctly hardens top-level WSDL parsing via StaxUtils, but delegates all <wsdl:import> and <xsd:import> resolution to WSDL4J, which lacks equivalent DOCTYPE and external entity restrictions - creating a security boundary mismatch that nullifies the top-level protections. No public exploit has been identified at time of analysis, but CWE-611 is a well-understood attack class with established tooling; successful exploitation against vulnerable deployments can yield arbitrary server-side file reads and SSRF. Vendor-released patches are available across three active release branches.

Technical ContextAI

Apache CXF (cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*) is a Java web services framework supporting SOAP and REST, widely used in enterprise environments for contract-first (WSDL-driven) service development. When loading a WSDL service definition, CXF uses its own StaxUtils-based XML parser for the top-level document, which disables XML DTDs and external entity resolution in compliance with guidance for CWE-611 (Improper Restriction of XML External Entity Reference). However, any document transitively referenced via <wsdl:import> or <xsd:import> is handed off to WSDL4J - a separate, third-party library - which does not enforce the same restrictions. Because WSDL definitions routinely reference external XSD schemas, this delegation path is a normal, expected code flow, not an edge case. The result is that an attacker-controlled import target can introduce DOCTYPE declarations and external entity references that the top-level parser never sees, bypassing the security hardening entirely at the WSDL4J parsing stage.

RemediationAI

The primary fix is upgrading to a patched Apache CXF release: 4.2.3 for 4.2.x deployments, 4.1.8 for 4.1.x deployments, or 3.6.12 for 3.6.x deployments, as specified in the Apache advisory at https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3. If immediate upgrade is blocked, a targeted compensating control is to audit all WSDL service definitions in the application and convert any external import URLs to local classpath references (e.g., using classpath: URI scheme), eliminating the attacker's ability to inject malicious content via the import chain - note this may require refactoring service configuration and could break functionality if remote schemas are integral to the service contract. As an additional network-layer defense, restricting outbound HTTP/HTTPS from the CXF service host reduces SSRF reachability and out-of-band data exfiltration via external entity fetching, though this does not prevent local file disclosure. Test network egress restrictions carefully before enforcing to avoid disrupting legitimate schema resolution. No workarounds for disabling WSDL4J's entity resolution directly are referenced in the advisory.