Vulnerability Description
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf | < 3.6.11 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4oMailing ListVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/security/cve/CVE-2026-44417
- https://bugzilla.redhat.com/show_bug.cgi?id=2480729
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json
FAQ
What is CVE-2026-44417?
CVE-2026-44417 is a vulnerability with a CVSS score of 7.5 (HIGH). The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted user...
How severe is CVE-2026-44417?
CVE-2026-44417 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44417?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf.