CVE-2026-44930 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-44930 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-44930 is an LDAP injection vulnerability affecting the LDAP Certificate repository component of the XKMS (XML Key Management Specification) server in Apache CXF.

Technical Detail

The flaw exists in how the XKMS server in Apache CXF constructs LDAP queries when interacting with its certificate repository, failing to properly sanitize or escape user-supplied input before it is incorporated into LDAP query strings. An attacker who can submit crafted input to the XKMS endpoint can manipulate the resulting LDAP query to retrieve arbitrary certificates from the repository beyond what they are authorized to access. The primary confirmed impact is unauthorized certificate retrieval, which could facilitate further attacks such as impersonation, traffic interception, or trust chain abuse depending on the role of the exposed certificates in the target environment.

Exploitation Status

No known exploit code has been publicly identified at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 reflects the low attack complexity and lack of authentication required to trigger the flaw, meaning exploitation would be straightforward once an attacker identifies a reachable XKMS endpoint.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability as of the date of this briefing.

What To Do

Apply the vendor-recommended patch from Apache for Apache CXF as soon as it becomes available, prioritizing any internet-facing or externally reachable deployments of the XKMS server. Until patching is complete, restrict network access to the XKMS service to trusted hosts only, using firewall rules or network segmentation to limit exposure. Review LDAP server logs for anomalous query patterns that may indicate reconnaissance or exploitation attempts against the certificate repository. Monitor the Apache CXF security advisories page for specific version guidance and confirmed fixed releases, as the available description indicates a recommendation was in progress at time of disclosure.