CVE-2026-44417

Published: May 22, 2026Modified: Jul 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected (3)

Products: Apache: Cxf

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 3.6.11
Apache Cxf	From 4.0.0 to 4.1.6
Apache Cxf	Version 4.2.0

Related CWEs

External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (5)

https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o

Source: security@apache.org

Mailing ListVendor Advisory

https://access.redhat.com/errata/RHSA-2026:37390

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/security/cve/CVE-2026-44417

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2480729

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.