CVE-2026-7262
SOAP apache:Map decoder with missing <value> vulnerability
MSRC advisory June 2, 2026
Alert details
- Source feed
- Microsoft MSRC
- CVE ID
- CVE-2026-7262
- Affected products
- SOAP apache:Map decoder with missing <value> · Apache SOAP apache:Map decoder with missing <value> · Apache
What happened
Information published.
What it means for your business
SOAP apache:Map decoder with missing vulnerability (CVE-2026-7262) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Sources
Related briefs
Apache Struts Command Injection Vulnerability
Apache Struts is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2016-3081). Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. CISA remediation due date: 2026-10-11. If you need help checking exposure, call (864) 335-9223.
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit vulnerability
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit vulnerability (CVE-2026-43871) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack vulnerability
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack vulnerability (CVE-2025-49506) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache Tomcat is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-34486). Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. CISA remediation due date: 2026-08-07. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.