CVE-2026-44618

CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality

Vendor Apache Software Foundation
Product Apache CXF
Weakness CWE-611 · XXE
Published May 22, 2026
Last update May 22, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Key dates

02Disclosure timeline

May 22, 2026 CVE published
May 22, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload CVE-2024-50442 WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability CVE-2025-32138 WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8