Apache CXF employs a hardened XML parsing approach for top‑level WSDL files, disabling DTDs and external entities. However, when a WSDL references additional WSDL or XSD files via <wsdl:import> or <xsd:import>, the imported documents are processed by WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, XML External Entity payloads in these imported files can resolve, allowing an attacker to read sensitive files or execute arbitrary code on the host, thereby exposing confidential data and enabling remote code execution.

Apache CXF deployments running any version older than the patched releases are vulnerable. The fix is implemented in Apache CXF 4.2.3, 4.1.8, and 3.6.12, so all earlier releases should be considered at risk.

The vulnerability is triggered remotely through a crafted WSDL or XSD import request. No CVSS or EPSS scores are currently available, and the issue is not listed in the CISA KEV catalog. Nevertheless, the lack of input validation for imported XML documents makes exploitation likely on unpatched systems, exposing the application to data disclosure or code execution risks.