CVE-2026-4374
XXE Vulnerability in RTI Connext Services Enables Data Exposure
Publication date: 2026-04-01
Last updated on: 2026-04-21
Assigner: RTI
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rti | connext_professional | From 5.3.0 (inc) to 5.3.1.45 (inc) |
| rti | connext_professional | From 6.0.0 (inc) to 6.0.1.40 (inc) |
| rti | connext_professional | From 6.1.0 (inc) to 6.1.2.27 (inc) |
| rti | connext_professional | From 7.0.0 (inc) to 7.3.1.1 (exc) |
| rti | connext_professional | From 7.4.0 (inc) to 7.7.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Restriction of XML External Entity (XXE) Reference in RTI Connext Professional components such as Routing Service, Observability Collector, Recording Service, Queueing Service, and Cloud Discovery Service. It allows Serialized Data External Linking and Data Serialization issues, which can lead to unauthorized access or manipulation of data.
How can this vulnerability impact me? :
The vulnerability can have a high impact as indicated by the CVSS base score of 8.8. It can allow attackers to exploit the improper restriction of XML external entities to access sensitive data, cause data serialization issues, or potentially execute unauthorized actions without requiring privileges or user interaction.