I am wrote and deployed a CXF web service into a Tomcat server using the instructions here. The web service deploys fine as I can see the WSDL file in a web browser.
I had similar problem
After adding this -Dorg.apache.cxf.stax.allowInsecureParser=1 to the JAVA_OPTIONS in setDomainEnv.sh, It is working fine now.
-Dorg.apache.cxf.stax.allowInsecureParser=1
JAVA_OPTIONS
setDomainEnv.sh