CVE-2026-65432 — cxf
HIGHCVE-2026-65432 is a high-severity (CVSS 7.5) XML External Entity (XXE) vulnerability. A fix is available — see the affected versions and patch details below.
Apache CXF: XXE via WSDL/XSD import parsing
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-65432.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Description
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import or xsd:import referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected Products
cxfapacheDetection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Fix
Upgrade the affected component to the fixed release for CVE-2026-65432, or apply your distribution's backported patch — distro builds are often patched at an older version number, so check your vendor's advisory rather than the upstream version alone.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Apache CXF is affected by an XML External Entity (XXE) vulnerability when processing imported WSDL/XSD content. The vulnerability exists because WSDL4J, which Apache CXF uses to parse WSDL imports, lacks restrictions on DTD declarations and external entity references. An attacker can exploit this to read arbitrary…
Update Apache CXF to a version that includes the fix. Disable DTD processing and external entity resolution in XML parsers. Avoid processing untrusted WSDL/XSD imports.Source: Red Hat security advisory for CVE-2026-65432 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Build of Apache Camel 3.33.4.redhat | org.apache.cxf/cxf-rt-wsdl:4.1.8.rhbac-redhat-00002 | RHSA-2026:83670 |
| Red Hat JBoss Enterprise Application Platform 8.1 | cxf-core | RHSA-2026:95887 |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 | eap8-apache-cxf-0:4.1.8-1.redhat_00001.1.el10eap | RHSA-2026:92059 |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | eap8-apache-cxf-0:4.1.8-1.redhat_00001.1.el8eap | RHSA-2026:92057 |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | eap8-apache-cxf-0:4.1.8-1.redhat_00001.1.el9eap | RHSA-2026:92056 |
Frequently Asked Questions
Is CVE-2026-65432 in your dependencies?
Find it across your dependency tree, including transitive dependencies.