CVE-2026-49875

🗓️ 12 Jun 2026 08:54:50Reported by MendType

mend🔗 www.mend.io👁 9 Views

Apache CXF SAXParserFactory construction allows OOB external entity resolution.

Reporter	Title	Published	Views	Family All 74
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)	21 Sep 202613:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty	12 Oct 202614:57	–	ibm
IBM Security Bulletins	Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update	26 Oct 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache CXF affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	22 Oct 202621:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)	16 Sep 202615:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ console is vulnerable to an External Entity Reference vulnerability (CVE-2026-49875)	29 Oct 202611:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)	16 Sep 202615:50	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is affected by multiple vulnerabilities	10 Oct 202603:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	4 Oct 202617:43	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Oct 202622:03	–	ibm

Source	Link
access	www.access.redhat.com/errata/RHSA-2026:36839
github	www.github.com/apache/cxf
access	www.access.redhat.com/errata/RHSA-2026:37390
repo	www.repo.maven.apache.org/maven2
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-49875
lists	www.lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o
openwall	www.openwall.com/lists/oss-security/2026/06/11/2
access	www.access.redhat.com/security/cve/CVE-2026-49875
cxf	www.cxf.apache.org/security-advisories.data/CVE-2026-49875.txt

07 Oct 2026 22:49Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.5 - 9.8

CVSS 47.1

EPSS0.00533

SSVC

Apache CXF SAXParserFactory external entity resolution out-of-band