EUVD-2026-36400
GHSA-93g8-qqv3-mrx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app exposing JMS config
-
DeliverySubmit malicious JMS configuration values
-
ExploitCXF parses untrusted JMS settings
-
ExecutionJMS transport contacts attacker endpoint
-
PersistRemote class loading or deserialization triggers
-
ImpactExecute code as CXF service user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the deploying application exposes Apache CXF's JMS transport configuration to untrusted users - for example, a multi-tenant integration product, an admin UI, or an API that accepts JMS connection factory, JNDI provider URL, or destination resolver values from non-administrators and feeds them into CXF. Limiting factors: the vast majority of CXF deployments hardcode JMS configuration in trusted application code or operator-controlled property files, in which case this CVE is not reachable; the affected versions are narrow (CXF 4.2.0-4.2.1 and anything below 4.1.7); and the CVSS AC:H reflects that the attacker must find or coerce a path through which their JMS configuration values actually reach the CXF JMS layer. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N with C/I/A all High yields 8.1, reflecting network reach and total impact but flagged High attack complexity because exploitation depends on the application exposing JMS configuration to untrusted users - a non-default deployment choice. EPSS at 0.04% (12th percentile) and SSVC Exploitation:none indicate no observed in-the-wild activity, while SSVC Automatable:yes and Technical Impact:total mean that once a working chain emerges it could scale. The vulnerability is not on the CISA KEV list, and no public exploit has been identified at time of analysis; this is a real priority for organisations that genuinely expose JMS configuration to untrusted users (multi-tenant integration platforms, low-code service builders), but for typical deployments where JMS is configured by trusted operators the practical risk is meaningfully lower than the 8.1 score suggests. The CVSS PR:N choice is defensible only under the assumption that 'configure JMS' is an exposed application function reachable without auth - defenders should verify whether their CXF deployment actually exposes that surface. |
| Exploit ScenarioDerived | An attacker who can reach an application function that forwards user-supplied JMS configuration into Apache CXF (for example, a tenant-administration page on an integration platform) submits a crafted JMS configuration referencing an attacker-controlled JNDI or broker endpoint. When CXF processes that configuration, the malicious endpoint coerces the CXF JVM into loading and executing attacker-controlled code, giving the attacker code execution with the privileges of the CXF service. No public exploit has been identified at time of analysis, but the prior CVE-2026-44417 chain provides a strong starting template. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 12, 2026
Remote code execution in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 can occur when untrusted users are permitted to configure JMS transport, representing a third attempt to fully address the original advisory CVE-2026-44417. With no public exploit identified at time of analysis and an EPSS score of 0.04%, near-term mass exploitation appears unlikely, but the SSVC technical impact is rated total and the flaw is deemed automatable once weaponized.
Earlier versions of this analysis (2)
Remote code execution in Apache CXF versions 4.2.0 through 4.2.1 and all versions before 4.1.7 is possible when untrusted users are permitted to configure JMS transport, representing an incomplete fix for the prior CVE-2026-44417 advisory. No public exploit identified at time of analysis, and EPSS rates exploitation probability at only 0.04% (12th percentile), reflecting the non-default configuration prerequisite. SSVC nonetheless rates technical impact as total and the flaw as automatable once conditions are met.
JNDI injection in Apache CXF's JMSConfigFactory (cxf-rt-transports-jms) enables remote code execution when untrusted users are permitted to supply JMS configuration values. This CVE represents an incomplete fix bypass of CVE-2026-44417, which addressed the same RCE attack class in the same component, meaning the original patch failed to close all exploit paths. No public exploit code has been identified at time of analysis; the vendor rates severity as moderate due to the privileged configuration prerequisite, and released corrective patches 4.2.2 and 4.1.7 on June 10, 2026.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 (for the 4.2.x branch) or 4.1.7 (for older supported branches), as documented in the Apache announcement at https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50632. Because this is the third fix attempt for the CVE-2026-44417 family, verify the upgrade is to at least these exact versions rather than relying on previously applied patches. Until the upgrade is rolled out, the most effective compensating control is to remove the ability for untrusted users to supply or influence JMS configuration values - for example, disable any administrative endpoints or low-code wizards that accept JMS connection factory URLs, JNDI provider URLs, or destination resolvers from non-administrators; the trade-off is loss of self-service JMS configuration for legitimate users. Additionally, restrict outbound network connectivity from the CXF process to known JMS broker hosts to blunt JNDI/remote-class-loading style payloads, accepting that this may break legitimate dynamic broker discovery.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and JMS-based web services in Java environments. The vulnerability lives in CXF's JMS transport configuration path, where attacker-controllable JMS settings (such as JNDI provider URLs or connection factory parameters) can be coerced into loading or invoking remote resources, ultimately leading to code execution in the CXF process. The root cause is CWE-20 (Improper Input Validation): prior fixes for CVE-2026-44417 attempted to constrain which JMS configuration values are accepted, but the validation remained incomplete and could still be bypassed when untrusted input reaches the JMS configuration layer.
Know when Cxf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable but requires an authenticated low-privileged user able to submit JMS configuration (PR:L) and a non-default exposed config surface (AC:H); successful exploitation yields full RCE.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Blast Radius
ecosystem impact- 6 maven packages depend on org.apache.cxf:cxf-rt-transports-jms (6 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.2.0.
Executive ViewAI
Apache CXF, a widely-deployed web services framework, contains a remote code execution vulnerability affecting versions 4.2.0-4.2.1 and all releases prior to 4.1.7 when JMS transport configuration is accessible to untrusted users. Organizations utilizing vulnerable versions face potential unauthorized code execution that could compromise business-critical systems and sensitive data handling. Immediate inventory and patch deployment is required to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Exploit-DB