Critical severity9.8NVD Advisory· Published Jun 12, 2026· Updated Jun 15, 2026

CVE-2026-49875

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Cxf2 versions
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <4.1.7
- (no CPE)range: <4.1.7, <4.2.2

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/06/11/2nvdMailing ListThird Party Advisory
lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79onvdVendor Advisory

News mentions

Apache CXF: Seven CVEs Disclosed Together, Including Two RCE Flaws and an Auth Bypass
Vypr Intelligence · Jun 12, 2026

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000