CVE-2026-49875

CRITICAL

INFO Priority: 0.05 BB Relevance: 80/100

Published: 2026-06-12 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: High

I: High

A: High

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Weakness Classification (1)

CWE-611

Affected Software (15)

Vendor	Product	Version
apache	cxf	< 4.1.7
apache	cxf	4.2.0 – 4.2.2
apache	cxf	< 3.6.12
apache	cxf	4.0.0 – 4.1.7
apache	cxf	4.2.0 – 4.2.2
redhat	build_of_apache_camel	< 3.33.2
redhat	build_of_apache_camel	< 4.18.1
redhat	build_of_apache_camel	3.33.2
redhat	build_of_apache_camel	3.33.2
redhat	build_of_apache_camel	4.18.1
redhat	fuse	7.0.0
redhat	jboss_enterprise_application_platform	8.1 – 8.1.8
redhat	jboss_enterprise_application_platform	7.0
redhat	jboss_web_server	5.0
redhat	single_sign-on	7.0