XML External Entity injection in Apache CXF - CVE-2026-65432
Published: August 24, 2026
Vulnerability identifier: #VU144825
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-65432
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper restriction of XML external entity references in WSDL4J import parsing when processing imported WSDL or XSD documents referenced by a top-level WSDL. A remote attacker can supply a specially crafted imported WSDL or XSD document to disclose sensitive information.
The issue affects imported documents referenced through <wsdl:import> or <xsd:import>, while the top-level WSDL is processed through a hardened parsing path.
Affected software
Apache CXF
Cloud Pak for Applications
Maximo Application Suite - Monitor Component
IBM WebSphere Application Server Liberty
Cloud Pak for Applications
Maximo Application Suite - Monitor Component
IBM WebSphere Application Server Liberty
How to mitigate CVE-2026-65432
Install security update from vendor's website.
Apache CXF - addressed in versions 3.6.12, 4.1.8, 4.2.3
Maximo Application Suite - Monitor Component - addressed in versions 9.0.25, 9.1.15, 9.2.4
IBM WebSphere Application Server Liberty - update to 26.0.0.10
Maximo Application Suite - Monitor Component - addressed in versions 9.0.25, 9.1.15, 9.2.4
IBM WebSphere Application Server Liberty - update to 26.0.0.10