High severity · published Oct 9, 2026
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CXF · Apache Software Foundation
4.2.0 before 4.2.4; 4.0.0 before 4.1.9; before 3.6.13 · source: vendor
CX
Cxf · Apache
before 3.6.13; 4.0.0 before 4.1.9; 4.2.0 before 4.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100227
vendor-advisory
https://lists.apache.org/thread.html/pst2oopnwt2rwhvkvmt5gdgwn36kq05m
More from Apache CXF
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository