CVE-2026-4374CWE-611xxe

CVE-2026-4374

Critical · published April 1, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-04-01T06:16Z
Affected products (5)
ProductVersionsFixed in
rti/connext_professional≥ 5.3.0, ≤ 5.3.1.45—
rti/connext_professional≥ 6.0.0, ≤ 6.0.1.40—
rti/connext_professional≥ 6.1.0, ≤ 6.1.2.27—
rti/connext_professional≥ 7.0.0, < 7.3.1.17.3.1.1
rti/connext_professional≥ 7.4.0, < 7.7.07.7.0
References (1)
https://www.rti.com/vulnerabilities/#cve-2026-4374 · 3f572a00-62e2-4423-959a-7ea25eff1638
EPSS history
Timeline
  • 01 APR 01:06Z
    Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (multiple infrastructure services) allows Serialized Data External Linking, Data Serialization External Entities Blowup.
    cvelistv5