Apache CXF RCE via Untrusted JMS Config Fixed in 4.2.1/4.1.6/3.6.11
CVE-2026-44417 Published on May 22, 2026

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-44417 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Types

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user. Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.


Products Associated with CVE-2026-44417

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-44417 are published in these products:

Apache CXF
 
Red Hat Camel Spring Boot
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Single Sign On
 
Red Hat Jbosseapxp
 
Red Hat Apache Camel Spring Boot
 

Affected Versions

Apache Software Foundation Apache CXF: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Single Sign-On 7:

Exploit Probability

EPSS
0.46%
Percentile
36.53%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.