CVE-2012-5575: Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a s...

Security readout for executives and security teams

This flaw lets an attacker push certain Apache CXF WS-Security encrypted traffic toward weaker cryptography than the service policy intended. The main business risk is confidentiality: protected SOAP communications may be easier to decrypt if vulnerable CXF versions are still in use. Exposure is most likely in legacy Java SOAP services or products embedding affected Apache CXF versions with WS-SecurityPolicy and XML Encryption enabled. Modern systems not using CXF SOAP security are unlikely to be affected. Prioritize remediation where legacy CXF protects sensitive business, customer, or partner SOAP traffic. Lower priority is reasonable for systems without CXF, without WS-Security XML Encryption, or already running fixed versions. Mitigation focus: Upgrade Apache CXF to 2.5.10, 2.6.7, 2.7.4, or later as applicable.; Check Apache CXF and Red Hat advisories for packaged-product update guidance.; Inventory vendor applications that bundle Apache CXF rather than exposing it directly..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.