Is CVE-2026-88901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88901 being exploited in the wild.

How severe is CVE-2026-88901?

High severity, with a CVSS score of 8.2, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.7.0 to 4.18.4, 4.19.0 to 4.22.0.

How is CVE-2026-88901 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88901?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88901: Apache Camel XXE in Smooks component

CVE-2026-88901 · Severity: high · CVSS 8.2 · Published 2026-10-19

Apache Camel's Smooks component is an XML processing framework used in message transformation pipelines. An attacker can send a crafted XML message to read files from the server or make network requests to internal hosts by exploiting improper entity handling. Organizations using Camel to process untrusted XML messages face data exposure and potential lateral movement risks.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-88901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88901 being exploited in the wild.
How severe is CVE-2026-88901?: High severity, with a CVSS score of 8.2, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.7.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-88901?: Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: Do not apply camel-smooks to XML received from untrusted senders until upgrading. Alternatively, declare a custom reader (EDI, CSV, JSON) instead of the default XML reader, which are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88901 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88901?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.5, 4.22.1, 4.23.0

Do not apply camel-smooks to XML received from untrusted senders until upgrading. Alternatively, declare a custom reader (EDI, CSV, JSON) instead of the default XML reader, which are not affected.

Technical details

The camel-smooks data format and smooks: endpoint use the Woodstox SAX parser without hardening to parse XML bodies, allowing resolution of external entities and external DTDs by default. An attacker supplying an XML message with DOCTYPE declarations or external entity references can read files accessible to the Camel process or trigger requests to internal network locations. The vulnerability affects versions 4.7.0–4.18.4 and 4.19.0–4.22.0; fixed versions disable external entity resolution by default.

Affected products

Apache Camel 4.7.0 to 4.18.4, 4.19.0 to 4.22.0

Timeline

2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.