Apache CXF’s EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, which permits out‑of‑band external entity resolution. This flaw can be used to read arbitrary local files or, if an attacker can influence the external entity, potentially execute code on the host system. The vulnerability is a classic XML External Entity (XXE) flaw and is classified as CWE‑611.

The issue affects Apache CXF implementations from the Apache Software Foundation that include the vulnerable classes. All versions prior to 4.2.2 and 4.1.7 are impacted, while those that have been updated to 4.2.2 or higher, or 4.1.7, are considered patched.

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so a precise likelihood cannot be quantified from public data. The CVSS score is 6.5, indicating a moderate severity risk. Nevertheless, the weakness requires an attacker to supply crafted XML input to the application; once the library processes that input, the external entity can be resolved. Thus the exploitability depends on whether the application exposes an endpoint that accepts user‑supplied XML. If such an endpoint exists, an attacker could feasibly trigger the XXE and exfiltrate data or affect local resources.