CVE-2026-44417highCWE-15 CWE-20

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.6%

probabilidad de explotación

0.6%top 51% de las CVE

explotación observada

noninguna fuente lo reporta

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Apache Software Foundation · Apache CXF

Referencias

https://access.redhat.com/errata/RHSA-2026:37390 https://access.redhat.com/security/cve/CVE-2026-44417 https://bugzilla.redhat.com/show_bug.cgi?id=2480729 https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json