CVE-2021-40690: Apache Cxf

High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days.

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Affected products

Apache Cxf: version 3.4.4 only
Apache Santuario XML Security For Java: before 2.1.7 (fixed in 2.1.7); from 2.2.0, before 2.2.3 (fixed in 2.2.3)
Apache Tomee: before 8.0.8 (fixed in 8.0.8)
Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
Oracle Agile Product Lifecycle Management: version 9.3.6 only
Oracle Commerce Guided Search: version 11.3.2 only
Oracle Commerce Platform: version 11.3.2 only
Oracle Communications Diameter Intelligence Hub: from 8.0.0, up to and including 8.1.0; from 8.2.0, up to and including 8.2.3
Oracle Communications Messaging Server: version 8.1 only
Oracle Flexcube Private Banking: version 12.1.0 only
Oracle Outside In Technology: version 8.5.5 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
Oracle Retail Bulk Data Integration: version 16.0.3 only
Oracle Retail Financial Integration: version 14.1.3.2 only; version 15.0.3.1 only; version 16.0.3 only; version 19.0.1 only
Oracle Retail Integration Bus: version 14.1.3.2 only; version 15.0.3.1 only; version 16.0.3 only; version 19.0.1 only
Oracle Retail Merchandising System: version 16.0.3 only; version 19.0.1 only
Oracle Retail Service Backbone: version 14.1.3.2 only; version 15.0.3.1 only; version 16.0.3 only; version 19.0.1 only
Oracle WebLogic Server: version 12.2.1.4.0 only; version 14.1.1.0.0 only

Published 2021-09-19. Last modified 2026-10-08.