CVE-2026-87830

published 2026-09-30

CVE-2026-87830: In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual…

Priority P3 53 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	wss4j	< 2.4.4	2.4.4
apache	wss4j	>= 3.0.0 < 3.0.6	3.0.6
apache	wss4j	>= 4.0.0 < 4.0.2	4.0.2
apache_software_foundation	apache_wss4j	< 2.4.4	2.4.4
apache_software_foundation	apache_wss4j	>= 3.0.0 < 3.0.6	3.0.6
apache_software_foundation	apache_wss4j	>= 4.0.0 < 4.0.2	4.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-917