EUVD-2026-36400
GHSA-93g8-qqv3-mrx8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable but requires an authenticated low-privileged user able to submit JMS configuration (PR:L) and a non-default exposed config surface (AC:H); successful exploitation yields full RCE.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7Description PRE-NVD
AnalysisAI
Remote code execution in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 can occur when untrusted users are permitted to configure JMS transport, representing a third attempt to fully address the original advisory CVE-2026-44417. With no public exploit identified at time of analysis and an EPSS score of 0.04%, near-term mass exploitation appears unlikely, but the SSVC technical impact is rated total and the flaw is deemed automatable once weaponized.
Technical ContextAI
Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and JMS-based web services in Java environments. The vulnerability lives in CXF's JMS transport configuration path, where attacker-controllable JMS settings (such as JNDI provider URLs or connection factory parameters) can be coerced into loading or invoking remote resources, ultimately leading to code execution in the CXF process. The root cause is CWE-20 (Improper Input Validation): prior fixes for CVE-2026-44417 attempted to constrain which JMS configuration values are accepted, but the validation remained incomplete and could still be bypassed when untrusted input reaches the JMS configuration layer.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 (for the 4.2.x branch) or 4.1.7 (for older supported branches), as documented in the Apache announcement at https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50632. Because this is the third fix attempt for the CVE-2026-44417 family, verify the upgrade is to at least these exact versions rather than relying on previously applied patches. Until the upgrade is rolled out, the most effective compensating control is to remove the ability for untrusted users to supply or influence JMS configuration values - for example, disable any administrative endpoints or low-code wizards that accept JMS connection factory URLs, JNDI provider URLs, or destination resolvers from non-administrators; the trade-off is loss of self-service JMS configuration for legitimate users. Additionally, restrict outbound network connectivity from the CXF process to known JMS broker hosts to blunt JNDI/remote-class-loading style payloads, accepting that this may break legitimate dynamic broker discovery.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today