CVE-2026-44930
A vulnerability in the Apache CXF XKMS server allows attackers to manipulate LDAP queries. This flaw can be used to extract unauthorized certificates from the LDAP Certificate repository.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of Apache CXF version 4.2.0 or earlier who utilize the XKMS server's LDAP Certificate repository.
Real-world impact
An attacker could remotely access and retrieve sensitive certificates stored in the LDAP repository without needing special permissions or user interaction.
Why this severity
This is a critical vulnerability because it can be exploited remotely over a network without any user interaction or authentication, potentially leading to a total loss of confidentiality, integrity, and availability of the certificate data.
What to do about it
- 01Upgrade Apache CXF to version 4.2.1, 4.1.6, or 3.6.11.
NVD-referenced vendor advisory
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.