CVE-2026-4374: CWE-611 Improper Restriction of XML External Entity Reference in RTI Connext Professional
CVE-2026-4374 is a high-severity vulnerability in RTI Connext Professional affecting multiple components including Routing Service, Observability Collector, Recording Service, Queueing Service, and Cloud Discovery Service. It involves improper restriction of XML External Entity (XXE) references, categorized under CWE-611. This flaw allows external linking in serialized data, potentially leading to data serialization issues. The vulnerability affects versions 5. 3. 0 through 7. 4. 0. There is no indication of known exploits in the wild, and no patch or official remediation information is currently provided.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-4374) in RTI Connext Professional arises from improper restriction of XML External Entity references (CWE-611). It impacts several components of the product, enabling serialized data external linking that could be exploited due to unsafe XML processing. The CVSS 4.0 base score is 8.8 (high), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality and availability. Affected versions include 5.3.0, 6.0.0, 6.1.0, 7.1.0, and 7.4.0. No patch or vendor advisory details are currently available to confirm remediation status.
Potential Impact
Successful exploitation could lead to unauthorized external entity references during XML processing, potentially exposing sensitive data or causing denial of service conditions. The high CVSS score indicates significant confidentiality and availability impacts. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating XML external entity processing risks by disabling or restricting external entity resolution in XML parsers if configurable. Monitor vendor communications for updates on patches or official mitigations.
CVE-2026-4374: CWE-611 Improper Restriction of XML External Entity Reference in RTI Connext Professional
Description
CVE-2026-4374 is a high-severity vulnerability in RTI Connext Professional affecting multiple components including Routing Service, Observability Collector, Recording Service, Queueing Service, and Cloud Discovery Service. It involves improper restriction of XML External Entity (XXE) references, categorized under CWE-611. This flaw allows external linking in serialized data, potentially leading to data serialization issues. The vulnerability affects versions 5. 3. 0 through 7. 4. 0. There is no indication of known exploits in the wild, and no patch or official remediation information is currently provided.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-4374) in RTI Connext Professional arises from improper restriction of XML External Entity references (CWE-611). It impacts several components of the product, enabling serialized data external linking that could be exploited due to unsafe XML processing. The CVSS 4.0 base score is 8.8 (high), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality and availability. Affected versions include 5.3.0, 6.0.0, 6.1.0, 7.1.0, and 7.4.0. No patch or vendor advisory details are currently available to confirm remediation status.
Potential Impact
Successful exploitation could lead to unauthorized external entity references during XML processing, potentially exposing sensitive data or causing denial of service conditions. The high CVSS score indicates significant confidentiality and availability impacts. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating XML external entity processing risks by disabling or restricting external entity resolution in XML parsers if configurable. Monitor vendor communications for updates on patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- RTI
- Date Reserved
- 2026-03-18T10:48:52.263Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69cc7a8ee6bfc5ba1d85412a
Added to database: 4/1/2026, 1:53:18 AM
Last enriched: 4/8/2026, 8:36:08 AM
Last updated: 5/16/2026, 10:34:24 AM
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.