{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-4374",
        "assignerOrgId": "3f572a00-62e2-4423-959a-7ea25eff1638",
        "state": "PUBLISHED",
        "assignerShortName": "RTI",
        "dateReserved": "2026-03-18T10:48:52.263Z",
        "datePublished": "2026-04-01T01:06:40.064Z",
        "dateUpdated": "2026-09-22T17:50:11.203Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Recording Service",
                        "Routing Service",
                        "Queueing Service",
                        "Cloud Discovery Service",
                        "Observability Collector"
                    ],
                    "product": "Connext Professional",
                    "packageName": "connext_professional",
                    "packageURL": "pkg:generic/connext_professional",
                    "vendor": "RTI",
                    "versions": [
                        {
                            "lessThan": "7.7.0",
                            "status": "affected",
                            "version": "7.4.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "7.3.1.1",
                            "status": "affected",
                            "version": "7.0.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "6.1.2.34",
                            "status": "affected",
                            "version": "6.1.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "6.0.*",
                            "status": "affected",
                            "version": "6.0.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.3.*",
                            "status": "affected",
                            "version": "5.3.0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "datePublic": "2026-03-25T17:31:28.467Z",
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup.<p>This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.</p>"
                        }
                    ],
                    "value": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-201",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-201 Serialized Data External Linking"
                        }
                    ]
                },
                {
                    "capecId": "CAPEC-221",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-221 Data Serialization External Entities Blowup"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "attackVector": "NETWORK",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "NONE",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                },
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "attackVector": "LOCAL",
                        "baseScore": 7,
                        "baseSeverity": "HIGH",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "NONE",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "Security Extensions Enabled"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-611",
                            "description": "CWE-611 Improper Restriction of XML External Entity Reference",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "3f572a00-62e2-4423-959a-7ea25eff1638",
                "shortName": "RTI",
                "dateUpdated": "2026-09-22T17:50:11.203Z"
            },
            "references": [
                {
                    "url": "https://www.rti.com/vulnerabilities/#cve-2026-4374"
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "title": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serializat...",
            "x_generator": {
                "engine": "RTI Lubna 1.16.2"
            },
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negated": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "7.4.0",
                                    "versionEndExcluding": "7.7.0"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "7.0.0",
                                    "versionEndExcluding": "7.3.1.1"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1.0",
                                    "versionEndExcluding": "6.1.2.34"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.0.0",
                                    "versionEndExcluding": "6.0.*"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.3.0",
                                    "versionEndExcluding": "5.3.*"
                                }
                            ]
                        }
                    ]
                }
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-04-01T14:23:31.865417Z",
                                "id": "CVE-2026-4374",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-04-01T15:51:42.809Z"
                }
            }
        ]
    }
}