CVEvulnerability

CVE-2026-44417

7.5 HIGH Published 2026-05-22 Modified 2026-07-23 Official page ↗
Status
Modified
Published
2026-05-22
Last modified
2026-07-23
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-15, CWE-20

Description

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected configurations

• apache cxf (< 3.6.11) • apache cxf (>= 4.0.0 < 4.1.6) • apache cxf 4.2.0

Related

Weakness · CWE (2)

  • CWE-15 External Control of System or Configuration Setting weakness
  • CWE-20 Improper Input Validation weakness

References