CVE-2026-100227

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100227

EUVD

EUVD-2026-95701

Affected Vendors & Products

Vendor	Product	Version / Range
apache	cxf	to 3.6.13 (exc)
apache	cxf	From 4.0.0 (inc) to 4.1.9 (exc)
apache	cxf	From 4.2.0 (inc) to 4.2.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability involves Apache CXF's JAX-RS XML Security module failing to verify that XML content is fully covered by a cryptographic signature. Attackers can exploit this by wrapping signed XML documents in unsigned content, tricking applications into treating the unsigned parts as signed.

Detection Guidance

This vulnerability involves improper verification of cryptographic signatures in Apache CXF's JAX-RS XML Security module. To detect it, check if your system uses vulnerable versions (3.6.0 to 3.6.12, 4.1.0 to 4.1.8, or 4.2.0 to 4.2.3). Inspect XML messages for unsigned content wrapped around signed content. No specific commands are provided in the context.

Impact Analysis

If you use Apache CXF's JAX-RS XML Security module, an attacker could manipulate XML data to bypass security checks. This may lead to unauthorized access, data tampering, or false authentication, depending on how the application processes the XML.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized modifications to signed XML documents. If attackers wrap unsigned content within signed documents, applications may process incorrect or malicious data as valid, undermining integrity requirements in these regulations.

Mitigation Strategies

Upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13 or later to address the improper verification of cryptographic signatures in the JAX-RS XML Security module.

Hi! I’m here to help you understand CVE-2026-100227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70