CVE-2026-44618CWE-611

Apache CXF: XXE vulnerability in WS-Transfer functionality

Medium · published May 22, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.

Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-05-22T12:17Z
EPSS history
Timeline
  • 22 MAY 12:17Z
    Apache CXF: XXE vulnerability in WS-Transfer functionality
    cvelistv5