GHSA-2hvc-5c6v-f533

ghsaUSosv

Apache CXF: Untrusted JMS configuration can lead to RCE

view advisory published 2026-05-26Licence: CC-BY-4.0

The fix for CVE-2025-48913: `Apache CXF: Untrusted JMS configuration can lead to RCE` was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-44417US	—	0.66% (51st)	—	2026-05-22
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilitie…

references

External citations — patches, advisories, analysis.

https://github.com/apache/cxfPACKAGE
https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4oWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-44417ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan