{"id":"CVE-2026-87830","published":"2026-09-30T12:17:14.087","lastModified":"2026-10-06T17:26:47.927","description":"In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-917"],"vendors":["apache"],"products":["wss4j"],"references":[{"url":"https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/9","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows a remote attacker to manipulate XPath expressions, potentially bypassing required signatures or encryption on SOAP messages, leading to unauthorized access or data exposure.","exploitability":"Exploitation requires control over a SOAP peer and knowledge of the affected XPath expressions, making it moderately difficult.","blast_radius":"If exploited, this could lead to unauthorized access to sensitive data or services, impacting system integrity and confidentiality.","remediation":"Upgrade to StAX streaming WS-SecurityPolicy validator versions 4.0.2, 3.0.6, or 2.4.4.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["soap","xml","security-policy","xpath","remote","data-exposure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:26.670Z"}}