CVE-2026-44618: Apache Cxf

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected products

• Apache Cxf: before 3.6.11 (fixed in 3.6.11); from 4.0.0, before 4.1.6 (fixed in 4.1.6); version 4.2.0 only

Published 2026-05-22. Last modified 2026-07-23.