Is CVE-2026-44618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44618 being exploited in the wild.

How severe is CVE-2026-44618?

Medium severity, with a CVSS score of 5.3, published 22 May 2026.

Which products and versions are affected?

Apache Software Foundation CXF = 4.0.0 < 4.1.6, 4.2.0, 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, all versions before 3.6.11; org.apache.cxf:cxf-rt-ws-transfer (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.1.

Is there a fix for CVE-2026-44618?

Yes. org.apache.cxf:cxf-rt-ws-transfer (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44618 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44618?

Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-ws-transfer (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44618: Apache CXF XXE in WS-Transfer module

Q: Is there a fix for CVE-2026-44618?

Yes. org.apache.cxf:cxf-rt-ws-transfer (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44618 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44618?

Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-ws-transfer (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44618 · Severity: medium · CVSS 5.3 · Published 2026-05-22

Apache CXF, a popular framework for building web services, contains a security flaw in its WS-Transfer module. This vulnerability could allow an attacker to read sensitive files from the server or conduct internal network scans by sending specially crafted XML data. Organizations using this library should update to the latest patched versions to prevent unauthorized data access.

Technologies: Apache Software Foundation CXF. Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-44618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44618 being exploited in the wild.
How severe is CVE-2026-44618?: Medium severity, with a CVSS score of 5.3, published 22 May 2026.
Which products and versions are affected?: Apache Software Foundation CXF < 3.6.11, >= 4.0.0 < 4.1.6, 4.2.0, 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, all versions before 3.6.11; org.apache.cxf:cxf-rt-ws-transfer (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.1.
Is there a fix for CVE-2026-44618?: Yes. org.apache.cxf:cxf-rt-ws-transfer (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44618 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44618?: Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-ws-transfer (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.cxf:cxf-rt-ws-transfer (Maven): upgrade to 4.2.1 or later

# set org.apache.cxf:cxf-rt-ws-transfer to 4.2.1 in your pom.xml or build.gradle

Technical details

An XML External Entity (XXE) vulnerability exists in the Apache CXF WS-Transfer module (cxf-rt-ws-transfer) due to an insecurely configured XML parser. The parser fails to properly restrict the resolution of external entity references within incoming XML messages. A remote, unauthenticated attacker can exploit this by sending a malicious XML payload to a service endpoint using WS-Transfer, potentially leading to the disclosure of local files, server-side request forgery (SSRF), or denial-of-service. The issue is resolved in versions 4.2.1, 4.1.6, and 3.6.11.

Affected products

Apache Software Foundation Apache CXF 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, all versions before 3.6.11

Identifiers

CVE-2026-44618
GHSA-vmm5-fjgx-2jhp

Timeline

2026-05-22: advisory: Initial disclosure by Apache Software Foundation
2026-05-22: patched: Fixes released in versions 4.2.1, 4.1.6, and 3.6.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.