CVE-2026-4374 is an XML external entity flaw (CVSS 9.1, critical) in several RTI Connext Professional services, including Recording Service, Routing Service, Queueing Service, Cloud Discovery Service and Observability Collector. Check your release against the version ranges in RTI's advisory and update.
What's affected
The record lists these ranges for Connext Professional:
- 7.4.0 before 7.7.0
- 7.0.0 before 7.3.1.1
- 6.1.0 before 6.1.2.34
- 6.0.0 before 6.0.* (as written in the record)
- 5.3.0 before 5.3.* (as written in the record)
The last two entries are given with wildcards, so the exact fixed builds for those lines are unclear. RTI keeps the authoritative list on its vulnerabilities page, which I could not retrieve. Use that page to confirm.
The affected components are the Recording, Routing, Queueing and Cloud Discovery services and the Observability Collector.
How to check if you're exposed
- Identify which of those services you run. They are separate executables from the core libraries.
- Read the Connext version from your installation. The install directory and installer record show the release.
- Compare it with the ranges above and with RTI's advisory.
- Find out which of these services accept XML from outside, for example configuration or discovery data sent over the network.
What to do now
- Open the RTI vulnerabilities page and find the entry for this CVE.
- Update the affected services to a fixed release for your version line.
- Restrict network access to the services so only trusted participants can reach them.
- Review who can supply XML configuration to these services.
- Record versions in your inventory.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity references. An XML parser that processes external entity definitions can be made to read local files or contact other systems named in the document. The record also names a blowup effect, where nested entities consume resources.
The impact scores for confidentiality and availability are high. Data distribution middleware often sits in industrial and embedded systems that are slow to patch. The KEV flag is false.
Quick check
Are the exact fixed versions confirmed?
Only partly. The record gives ranges, two of which use wildcards. Confirm fixes with RTI.
Sources
Last reviewed: 19 October 2026.
