Loading vulnerability…
XXE in Apache CXF WSDL/XSD Import Parsing
CVE-2026-65432 is an XML External Entity vulnerability in Apache CXF's WSDL/XSD import processing. Top-level WSDL documents are parsed through the hardened StaxUtils path, which disables DTDs and external entities, but documents referenced by wsdl:import or xsd:import are delegated to WSDL4J without equivalent restrictions. Imported documents can therefore contain DOCTYPE declarations and external entities that bypass the top-level parser protections. Affected releases include versions before 3.6.12, versions from 4.0.0 through versions before 4.1.8, and versions from 4.2.0 through versions before 4.2.3. Exploitation can potentially expose local resources or induce server-side requests, depending on the deployment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malicious imported WSDL or XSD documents can trigger external entity resolution within the application process. Depending on parser behavior, process permissions, network access, and whether resolved data can be observed, this may permit unauthorized local file access, sensitive information disclosure, or server-side request forgery. Hardening of the top-level WSDL parser does not prevent exploitation through imported documents.
If you can’t patch tonight, do this now.
No separate vendor workaround is specified. Pending upgrade, restrict WSDL/XSD processing to trusted documents and trusted import sources, and prevent attacker-controlled imported documents from reaching the parser. Restrict application-process filesystem permissions and outbound network access to reduce potential XXE impact. These compensating controls do not replace the fixed release.
Patch, then assume compromise.
Upgrade Apache CXF to the appropriate fixed release: 4.2.3, 4.1.8, or 3.6.12. For Red Hat JBoss EAP 8.1 deployments on RHEL 8, 9, or 10, apply the corresponding vendor security update to EAP 8.1.9, which includes patched Apache CXF packages. Apply relevant prerequisite errata and back up applications, configuration, and databases before updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.