VULNERABILITY INTELLIGENCE
CVE-2026-44930
CVSS score9.8 CRITICAL
EPSS probability0.72%
CISA KEVNot currently listed
Published2026-05-22
Last modified2026-07-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Weakness classification
- security@apache.org: CWE-90
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-90