https://seclists.org/oss-sec/2026/q3/471: CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing
Published Aug 6, 2026
·Updated
Affected Software
3 affected components
Apache Apache CXF>4.2.0<=4.2.3
Apache Apache CXF>4.0.0<=4.1.8
Apache Apache CXF<3.6.12
Frequently Asked Questions
1
What is the severity of CVE-2026-65432?
CVE-2026-65432 has been assigned a medium severity rating due to the risk of XML External Entity (XXE) injection.
2
How do I fix CVE-2026-65432?
To mitigate CVE-2026-65432, users should upgrade to a patched version of Apache CXF that resolves the XXE vulnerability.
3
What versions of Apache CXF are affected by CVE-2026-65432?
CVE-2026-65432 affects all versions of Apache CXF prior to the fixed release made available on August 6, 2026.
4
What types of attacks can be executed using CVE-2026-65432?
Exploiting CVE-2026-65432 can allow attackers to conduct XML External Entity attacks, potentially leading to data exfiltration or system compromise.
5
Is there a workaround for CVE-2026-65432 if I cannot update Apache CXF?
A possible workaround for CVE-2026-65432 is to disable XML entity expansion or to validate WSDL/XSD files before processing.