CVE-2026-87830

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.0.2 Apache CXF versions prior to 3.0.6 Apache CXF versions prior to 2.4.4

Description In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions (a language used to navigate through elements and attributes in an XML document) can be converted into paths that never match the actual XML element path. This allows a remote SOAP peer to send a required element without the expected signature or encryption.

Recommendations Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.