VulnSocial

CVE-2026-44618Disclosure(apache / cxf)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache cxf systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-611

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cxf

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-05-22); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
apache
Products
cxf

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-22: 1Mentions · 2026-05-23: 1Mentions · 2026-07-20: 1Patch / Workaround · 2026-07-20: 1Technical Details · 2026-05-23: 1Technical Details · 2026-07-20: 105-2205-2307-20
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-05-221
General1
2026-05-231
Disclosure1
2026-07-201
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    Apache CXF CVE-2026-44417: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE https://www.openwall.com/lists/oss-security/2026/05/22/7 CVE-2026-44618: XXE in WS-Transfer functionality https://www.openwall.com/lists/oss-security/2026/05/22/8 CVE-2026-44930: LDAP Injection in XKMS LDAP Repository https://www.openwall.com/lists/oss-security/2026/05/22/9

    Post summary

    The post announces three new Apache CXF CVEs, briefly describes each vulnerability type, and links to discussion threads, without providing PoC, exploit, or patch details.

    010511.2K
    4.7K followersView on X
  • VulniPulse@vulnipulse
    Disclosure

    ⚠️ NetApp Active IQ Unified Manager for Linux alert: CVE-2026-44618 (CVSS 5.3) Attackers could affect the listed product. No workaround is available; follow the vendor advisory for updates. https://vulnipulse.com/advisories/netapp-ntap-20260618-0003 #NetApp #CyberSecurity #CVE

    Post summary

    The tweet announces a new vulnerability in NetApp Active IQ Unified Manager for Linux (CVE-2026-44618, CVSS 5.3) and advises following the vendor advisory for updates, noting no workaround is available.

    0000045
    6 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-44618 CVE-2026-44618 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44618

    Post summary

    The text merely repeats the CVE identifier and provides a link, with no substantive details or actionable information.

    0000071
    4.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appapachecxf---
Appapachecxf4.2.0--

Explore more

Back to dashboardapache CVEscxf vulnerabilities