Lucene search
+L

CVE-2026-49875

🗓️ 12 Jun 2026 08:54:50Reported by apacheType 
cve
 cve
🔗 web.nvd.nist.gov👁 367 Views

CVE-2026-49875: CXF XXE via unhardened SAXParserFactory; upgrade to 4.2.2 or 4.1.7.

Related
Detection
Affected
Refs
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)
21 Sep 202613:47
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
12 Oct 202614:57
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)
16 Sep 202615:50
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)
16 Sep 202615:50
–ibm
ibm
IBM Security Bulletins
Security Bulletin: Due to the use of WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is affected by multiple vulnerabilities
10 Oct 202603:47
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
4 Oct 202617:43
–ibm
ibm
IBM Security Bulletins
Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway
7 Oct 202622:03
–ibm
ibm
IBM Security Bulletins
Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
16 Sep 202609:15
–ibm
ibm
IBM Security Bulletins
Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.
5 Oct 202615:00
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)
8 Sep 202616:33
–ibm
Rows per page
NVD
Vulners
Node
OR
apachecxfRange<4.1.7
apachecxfRange4.2.0–4.2.2
[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.cxf:cxf-core",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.2.2",
        "status": "affected",
        "version": "4.2.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.1.7",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.6.12",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

07 Aug 2026 13:16Current
5.7Medium risk
Vulners AI Score5.7
CVSS 3.17.5 - 9.8
EPSS0.00807
SSVC
367