CVE-2026-49875: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-12 · updated 2026-10-29
Weakness: CWE-611

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Affected products

Apache Software Foundation Apache CXF: before 3.6.12; from 4.0.0 before 4.1.7; from 4.2.0 before 4.2.2 — fixed in 3.6.12, 4.1.7, 4.2.2
RedHat Build Of Apache Camel: before 3.33.2; before 4.18.1; 3.33.2-update1; 3.33.2, 4.18.1 — fixed in 3.33.2, 4.18.1
Red Hat Fuse: 7.0.0 (and their updates)
Red Hat JBoss EAP: from 8.1 before 8.1.8; 7.0 (and their updates) — fixed in 8.1.8
RedHat Jboss Web Server: 5.0 (and their updates)
Red Hat Single Sign-On: 7.0 (and their updates)

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.6.12, 4.1.7, 4.2.2; RedHat Build Of Apache Camel 3.33.2, 4.18.1; Red Hat JBoss EAP 8.1.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-49875 or the next vulnerability affects your stack