CVE-2026-49875

CriticalCVSS 9.8

Published: 12/06/2026(UTC)Updated: 07/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

42th percentile - higher than 42% of all known CVEs

Summary

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory construct a SAXParserFactory without proper JAXP hardening, enabling out-of-band external entity resolution.

Risk Assessment

An attacker could exploit this to read files or perform SSRF attacks, potentially leading to data leakage.

Recommendation

Upgrade to versions 4.2.2, 4.1.7, or 3.6.12, which fix this issue.

Original NVD description (English source)

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.