CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-49875

CWE-611

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

CVSS Score
—
Unrated
EPSS — Exploit Probability
0.5%
Riskier than 41% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
NVD entry PoC / advisory

1 article across 1 outlet · first covered Jun 13, 2026 · latest Jun 13, 2026

Coverage timeline