Critical severity9.8NVD Advisory· Published Jun 12, 2026· Updated Aug 7, 2026

CVE-2026-49875

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Cxfllm-fuzzy2 versions
before 4.2.2, 4.1.7, or 3.6.12+ 1 more
- (no CPE)range: before 4.2.2, 4.1.7, or 3.6.12
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <4.1.7

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/06/11/2nvdMailing ListThird Party Advisory
lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79onvdVendor Advisory
access.redhat.com/errata/RHSA-2026:36839nvd
access.redhat.com/errata/RHSA-2026:37390nvd
access.redhat.com/security/cve/CVE-2026-49875nvd
bugzilla.redhat.com/show_bug.cginvd
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.jsonnvd

News mentions

Apache CXF: Seven CVEs Disclosed Together, Including Two RCE Flaws and an Auth Bypass
Vypr Intelligence · Jun 12, 2026

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000