Description (CNA)
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache CXF | affected 4.2.0 before 4.2.2; affected 4.0.0 before 4.1.7; affected 0 before 3.6.12 |
CWE
CWE-20
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Apache CXF. This vulnerability, stemming from an incomplete fix for a previous issue, allows untrusted users who can configure Java Message Service (JMS) for Apache CXF to achieve arbitrary code execution. This could lead to a complete compromise of the affected system.