CVE-2026-44930

CriticalCVSS 9.8

Published: 22/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.72%

50th percentile - higher than 50% of all known CVEs

Summary

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF. It allows an attacker to retrieve arbitrary certificates from the repository.

Risk Assessment

An attacker can gain unauthorized access to sensitive certificates, potentially compromising the integrity and confidentiality of communications.

Recommendation

It is recommended to upgrade to versions 4.2.1, 4.1.6, or 3.6.11, which fix this issue.

Original NVD description (English source)

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.