CVE-2026-4374: Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serializat...

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-01 · updated 2026-09-22
Weakness: CWE-611

Description

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

Affected products

RTI Connext Professional: from 5.3.0 through 5.3.1.45; from 6.0.0 through 6.0.1.40; from 6.1.0 through 6.1.2.27; from 7.0.0 before 7.3.1.1; from 7.4.0 before 7.7.0 — fixed in 7.3.1.1, 7.7.0

How to fix

Upgrade to a fixed version: RTI Connext Professional 7.3.1.1, 7.7.0. Check the vendor advisory for mitigations.

References

https://www.rti.com/vulnerabilities/#cve-2026-4374

Get alerted when CVE-2026-4374 or the next vulnerability affects your stack