CVE-2026-4374 PUBLISHED

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat...

Assigner: RTI
Reserved: 18.03.2026 Published: 01.04.2026 Updated: 01.04.2026

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat...

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.8
CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7

Security Extensions Enabled

Product Status

Vendor RTI
Product Connext Professional
Versions Default: unaffected
  • affected from 7.4.0 to 7.7.0 (excl.)
  • affected from 7.1.0 to 7.3.1.1 (excl.)
  • affected from 6.1.0 to 6.1.* (excl.)
  • affected from 6.0.0 to 6.0.* (excl.)
  • affected from 5.3.0 to 5.3.* (excl.)

References

Problem Types

  • CWE-611 Improper Restriction of XML External Entity Reference CWE

Impacts

  • CAPEC-201 Serialized Data External Linking
  • CAPEC-221 Data Serialization External Entities Blowup