CVE-2026-4374

Published: Apr 1, 2026Modified: Sep 22, 2026

8.8

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 3f572a00-62e2-4423-959a-7ea25eff1638 (Secondary)

Description

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

Affected (5)

Products: Rti: Connext Professional

Rti

1 product

Connext Professional

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Rti Connext Professional	5.3.0 ≤ version ≤ 5.3.1.45
Rti Connext Professional	6.0.0 ≤ version ≤ 6.0.1.40
Rti Connext Professional	6.1.0 ≤ version ≤ 6.1.2.27
Rti Connext Professional	7.0.0 ≤ version < 7.3.1.1
Rti Connext Professional	7.4.0 ≤ version < 7.7.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

https://www.rti.com/vulnerabilities/#cve-2026-4374

Source: 3f572a00-62e2-4423-959a-7ea25eff1638

Vendor Advisory

Timeline

No history available yet.