by Kastro
Paper/Archive/CVE-2026-4374

CVE-2026-4374

RTI Connext Professional — Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serializat...

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 15.1.151 × 203.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

Affected

ProductAffectedFixed inSource
Connext Professional7.4.0 – < 7.7.07.7.0CNA
Connext Professional7.0.0 – < 7.3.1.17.3.1.1CNA
Connext Professional6.1.0 – < 6.1.2.346.1.2.34CNA
Connext Professional6.0.0 – < 6.0.*6.0.*CNA
Connext Professional5.3.0 – < 5.3.*5.3.*CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
RTI (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refrti.com/vulnerabilities/#cve-2026-4374