CVE-2026-4374CRITICAL 9.1EPSS p30.8%
CVE-2026-4374CVE-2026-4374
rti / connext_professional
Description
Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.
Scoring
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| EPSS | 0.39% probability of exploitation · percentile 30.8% · 2026-10-05T12:00:23Z |
| Published | 2026-04-01 |
| Last modified | 2026-09-22 |
Underlying weaknesses· 1
References
1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Restriction of XML External Entity Referencecwe-611 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.