CVE-2026-49875: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Security readout for executives and security teams

Apache CXF, a widely used Java framework for building web services, has a flaw that lets a crafted XML message trick the server into contacting attacker-controlled systems and leaking data. Any application processing untrusted XML through the affected components is at risk. The Apache project has released fixed versions (4.2.2 and 4.1.7) that harden the XML parser. Java services built on Apache CXF that parse SOAP, WS-Addressing endpoint references, or schemas from untrusted sources are exposed. Downstream consumers include Red Hat middleware distributions (RHSA-2026:36839 and RHSA-2026:37390). Internet-facing SOAP/JAX-WS endpoints and integration brokers relying on cxf-core prior to 4.2.2 or 4.1.7 face the highest risk. Treat as a scheduled high-priority patch cycle item this sprint. Confidentiality impact is high, no authentication is required, and Red Hat has already shipped errata, indicating meaningful downstream exposure. Assign ownership to the Java platform and middleware teams and confirm remediation within standard high-severity SLAs. Mitigation focus: Upgrade Apache CXF to 4.2.2 or 4.1.7 (or the fixed vendor package) across all deployments.; Apply Red Hat errata RHSA-2026:36839 and RHSA-2026:37390 where applicable.; Restrict outbound network egress from CXF service hosts to limit out-of-band exfiltration..

Prepared

Jul 11, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.