CVE-2026-49875General(apache / cxf)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache cxf systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-611

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 2d ago at 2 mentions (2026-06-12); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

apache

Products

cxf

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

General

250.0%

Disclosure

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	2	General2
2026-06-15	1	Disclosure1
2026-07-20	1	Disclosure1

Full discourse4 posts

VulniPulse@vulnipulse99d
Disclosure
⚠️ NetApp Active IQ Unified Manager for Linux alert: CVE-2026-49875 (CVSS 9.8) Attackers could disrupt service or cause a denial of service. No workaround is available; follow the vendor advisory for updates. https://vulnipulse.com/advisories/netapp-ntap-20260618-0004 #NetApp #CyberSecurity #CVE
Post summary
NetApp issues an alert for CVE-2026-49875, a high‑severity denial‑of‑service vulnerability (CVSS 9.8) with no workaround available, directing users to a vendor advisory.
0000044
6 followersView on X
SecAlerts@SecAlertsCo134d
Disclosure
🪵 Apache CXF hit with a critical XXE (9.8). CVE-2026-49875 affects W3CMultiSchemaFactory & EndpointReferenceUtils — no auth needed, full OOB entity resolution over the network. Check your CXF version now. #Apache #AppSec https://secalerts.co/vulnerability/CVE-2026-49875 https://t.co/QlquyZHHLe
Post summary
The tweet announces a critical XXE vulnerability (CVE‑2026‑49875) in Apache CXF with a CVSS score of 9.8, enabling unauthenticated remote OOB entity resolution, but provides no PoC, exploit code, or patch information.
0000062
835 followersView on X
Infoflowcloud@infoflowcloud137d
General
🚨*CVE* CVE-2026-49875 Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-o… https://www.cve.org/CVERecord?id=CVE-2026-49875 ----- Traducción: CVE-2026-49875 Las… http://infoflow.cloud`
Post summary
The tweet offers a brief technical description of CVE‑2026‑49875 affecting Apache CXF’s SAXParserFactory construction but provides no PoC, exploit tool, active exploitation, or patch information.
0000021
79 followersView on X
CVE@CVEnew137d
General
CVE-2026-49875 Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-o… https://www.cve.org/CVERecord?id=CVE-2026-49875
Post summary
A brief tweet cites CVE-2026-49875, noting a lack of JAXP hardening in Apache CXF’s SAXParserFactory that could lead to a vulnerability, but it offers no evidence of exploitation, patches, or a proof of concept.
00000157
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	cxf	-	-	-

Explore more

Back to dashboard apache CVEs cxf vulnerabilities

What researchers are saying

CVE-2026-49875

VulniPulse[verified]@vulnipulseDisclosure

NetApp issues an alert for CVE-2026-49875, a high‑severity denial‑of‑service vulnerability (CVSS 9.8) with no workaround available, directing users to a vendor advisory.

SecAlerts@SecAlertsCoDisclosure

The tweet announces a critical XXE vulnerability (CVE‑2026‑49875) in Apache CXF with a CVSS score of 9.8, enabling unauthenticated remote OOB entity resolution, but provides no PoC, exploit code, or patch information.

Infoflowcloud@infoflowcloudGeneral

The tweet offers a brief technical description of CVE‑2026‑49875 affecting Apache CXF’s SAXParserFactory construction but provides no PoC, exploit tool, active exploitation, or patch information.

CVE@CVEnewGeneral

A brief tweet cites CVE-2026-49875, noting a lack of JAXP hardening in Apache CXF’s SAXParserFactory that could lead to a vulnerability, but it offers no evidence of exploitation, patches, or a proof of concept.