CVE-2026-65432

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	>= 4.2.0, < 4.2.3; >= 4.0.0, < 4.1.8; < 3.6.12

References

https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/17

Timeline

Published: Aug 6, 2026
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-654336.5Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-654346.5Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.CVE-2026-654356.5Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.CVE-2026-654366.8Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.CVE-2026-654377.1Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.CVE-2026-654387.1Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.CVE-2026-654397.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.CVE-2026-65446.2IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of CVE-2026-654407.1Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.CVE-2026-654417.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.CVE-2026-654427.2Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.CVE-2026-654437.1Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.