{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4374", "assignerOrgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "state": "PUBLISHED", "assignerShortName": "RTI", "dateReserved": "2026-03-18T10:48:52.263Z", "datePublished": "2026-04-01T01:06:40.064Z", "dateUpdated": "2026-04-01T15:51:42.809Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Routing Service", "Observability Collector", "Recording Service", "Queueing Service", "Cloud Discovery Service"], "product": "Connext Professional", "packageName": "connext_professional", "packageURL": "pkg:generic/connext_professional", "vendor": "RTI", "versions": [{"lessThan": "7.7.0", "status": "affected", "version": "7.4.0", "versionType": "custom"}, {"lessThan": "7.3.1.1", "status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThan": "6.1.*", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "6.0.*", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "5.3.*", "status": "affected", "version": "5.3.0", "versionType": "custom"}]}], "datePublic": "2026-03-25T17:31:28.467Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat..."}], "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat..."}], "impacts": [{"capecId": "CAPEC-201", "descriptions": [{"lang": "en", "value": "CAPEC-201 Serialized Data External Linking"}]}, {"capecId": "CAPEC-221", "descriptions": [{"lang": "en", "value": "CAPEC-221 Data Serialization External Entities Blowup"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "Security Extensions Enabled"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "shortName": "RTI", "dateUpdated": "2026-04-01T01:06:40.064Z"}, "references": [{"url": "https://www.rti.com/vulnerabilities/#cve-2026-4374"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat...", "x_generator": {"engine": "RTI Lubna 1.16.2"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negated": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.4.0", "versionEndExcluding": "7.7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.3.1.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.0", "versionEndExcluding": "5.3.*"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T14:23:31.865417Z", "id": "CVE-2026-4374", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T15:51:42.809Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4374", "assignerOrgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "state": "PUBLISHED", "assignerShortName": "RTI", "dateReserved": "2026-03-18T10:48:52.263Z", "datePublished": "2026-04-01T01:06:40.064Z", "dateUpdated": "2026-04-01T15:51:42.809Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Routing Service", "Observability Collector", "Recording Service", "Queueing Service", "Cloud Discovery Service"], "product": "Connext Professional", "packageName": "connext_professional", "packageURL": "pkg:generic/connext_professional", "vendor": "RTI", "versions": [{"lessThan": "7.7.0", "status": "affected", "version": "7.4.0", "versionType": "custom"}, {"lessThan": "7.3.1.1", "status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThan": "6.1.*", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "6.0.*", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "5.3.*", "status": "affected", "version": "5.3.0", "versionType": "custom"}]}], "datePublic": "2026-03-25T17:31:28.467Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat..."}], "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat..."}], "impacts": [{"capecId": "CAPEC-201", "descriptions": [{"lang": "en", "value": "CAPEC-201 Serialized Data External Linking"}]}, {"capecId": "CAPEC-221", "descriptions": [{"lang": "en", "value": "CAPEC-221 Data Serialization External Entities Blowup"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "Security Extensions Enabled"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "shortName": "RTI", "dateUpdated": "2026-04-01T01:06:40.064Z"}, "references": [{"url": "https://www.rti.com/vulnerabilities/#cve-2026-4374"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat...", "x_generator": {"engine": "RTI Lubna 1.16.2"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negated": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.4.0", "versionEndExcluding": "7.7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.3.1.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.0", "versionEndExcluding": "5.3.*"}]}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4374", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T14:23:31.865417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T14:23:36.981Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8B1FE0A-A2E0-45AA-9ED2-CED9BDA02047", "versionEndIncluding": "5.3.1.45", "versionStartIncluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "8369CEAE-4767-4910-AD55-3C6E8898EE5F", "versionEndIncluding": "6.0.1.40", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "2042782E-93AB-4D92-9DB0-3377557B5B46", "versionEndIncluding": "6.1.2.27", "versionStartIncluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F77FCD6-D5AC-46DF-99BF-D9E30919B5E4", "versionEndExcluding": "7.3.1.1", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF87EB0F-A1CD-40D1-96F0-53D964E34BFC", "versionEndExcluding": "7.7.0", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat..."}, {"lang": "es", "value": "Vulnerabilidad de restricci\u00f3n incorrecta de referencia a entidad externa XML en RTI Connext Professional (Routing Service, Observability Collector, Recording Service, Queueing Service, Cloud Discovery Service) permite el enlace externo de datos serializados, la serializaci\u00f3n de datos..."}], "id": "CVE-2026-4374", "lastModified": "2026-04-21T00:06:11.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "3f572a00-62e2-4423-959a-7ea25eff1638", "type": "Secondary"}]}, "published": "2026-04-01T02:16:03.540", "references": [{"source": "3f572a00-62e2-4423-959a-7ea25eff1638", "tags": ["Vendor Advisory"], "url": "https://www.rti.com/vulnerabilities/#cve-2026-4374"}], "sourceIdentifier": "3f572a00-62e2-4423-959a-7ea25eff1638", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "3f572a00-62e2-4423-959a-7ea25eff1638", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.7.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.1.0,7.3.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,6.2.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.3.0,5.4.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Connext Professional", "source": "cna", "vendor": "RTI"}, "product": "connext_professional", "vendor": "rti"}], "analysis": {"en": {"generated_at": "2026-04-01T06:29:35.894592+00:00", "value": {"mitigation_remediation": ["Apply the vendor-provided patch when it becomes available", "Disable XML external entity processing in all RTI Connext components if configuration options allow", "Implement strict validation of XML inputs to reject or sanitize external entity references", "Monitor system logs for suspicious XML parsing activity", "Regularly check the RTI security advisory page for updates and new mitigations"], "summary": {"action": "Immediate Patch", "impact": "Potential for unauthorized data exposure or remote code execution via XML External Entity processing"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the RTI Connext Professional product suite, specifically its Routing Service, Observability Collector, Recording Service, Queueing Service, and Cloud Discovery Service. No specific version information is provided; all released versions under the Connext Professional portfolio are potentially impacted until a patch is issued.", "description_and_impact": "RTI Connext Professional\u2014including Routing Service, Observability Collector, Recording Service, Queueing Service, and Cloud Discovery Service\u2014contains an improper restriction of XML External Entity (XXE) references. This flaw enables the processing of serialized data that can reference external XML entities. If an attacker supplies crafted XML, the affected components may read local files, access network resources, or execute code embedded in external entities, leading to data exfiltration or, in worst cases, arbitrary code execution.", "risk_and_exploitability": "The CVSS v3.1 score is 7.0, indicating a high impact severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting current exploit evidence may be limited. However, the attack vector is inferred to be remote through untrusted XML input, meaning an attacker could remotely inject malicious XML payloads to trigger the vulnerability. Given the nature of XXE weaknesses and the high CVSS, the risk to affected systems remains significant until mitigated."}}}}, "created": "2026-04-02T07:50:30.005330+00:00", "updated": "2026-04-02T20:18:36.276412+00:00", "vendors": ["rti", "rti$PRODUCT$connext_professional"]}