CVE-2026-49875

[CVE catalog]

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jun 11, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band (OOB) external entity resolution, a type of XML External Entity (XXE) vulnerability. A remote attacker could exploit this to disclose sensitive information from the affected system. cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening This is an Important information disclosure vulnerability in Apache CXF, affecting Red Hat products that bundle the component, such as Enterprise Application Platform, JBoss Web Server, and Red Hat Single Sign-On. The flaw allows a remote attacker to disclose sensitive information due to improper XML parsing configurations, which can be exploited without user interaction. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.