CVE-2026-44618
MEDIUM
apache
cxf
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
May 22, 2026
Vendor
apache
Description
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.