CVE-2026-44618— Apache CXF: XXE vulnerability in WS-Transfer functionality
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0< 4.2.1 | affected |
4.0.0< 4.1.6 | affected | ||
< 3.6.11 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44618
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CXF: XXE vulnerability in WS-Transfer functionality
Source: NVD (National Vulnerability Database)
Vulnerability Description
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 ~ 4.2.1 | - |
II. Public POCs for CVE-2026-44618
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44618
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-44618 (1)
Same Patch Batch · Apache Software Foundation · 2026-05-22 · 3 CVEs total
| CVE-2026-44417 | Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE | |
| CVE-2026-44930 | Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository |
IV. Related Vulnerabilities
Same product: Apache CXF
- CVE-2026-44417
Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS - CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Reposi - CVE-2025-48913
Apache CXF: Untrusted JMS configuration can lead to RCE - CVE-2025-48795
Apache CXF: Denial of Service and sensitive data exposure in - CVE-2025-23184
Apache CXF: Denial of Service vulnerability with temporary f
Same vendor: Apache Software Foundation
- CVE-2026-42797
Apache Syncope: JexlContextBuilder Information Disclosure - CVE-2026-42782
Apache Syncope: Post-auth RCE via Groovy static - CVE-2026-46745
Apache Airflow FAB provider: LDAP Filter Injection in FAB Au - CVE-2026-45361
Apache Airflow Google provider: SSH host key verification di - CVE-2026-45249
Apache ECharts: XSS in Lines series tooltip rendering
Same weakness: CWE-611
- CVE-2026-46722
XML External Entity Injection in extension "Faceted Search" - CVE-2026-44445
ERPNext: XML External Entity (XEE) Reference Vulnerability i - CVE-2026-41895
changedetection.io: XXE vulnerability in the changedetection - CVE-2026-41936
Vvveb < 1.0.8.2 XML External Entity Injection via Import - CVE-2026-40682
Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntr
V. Comments for CVE-2026-44618
No comments yet