Vulnerability Description
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf | < 4.1.7 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcwVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/security/cve/CVE-2026-50632
- https://bugzilla.redhat.com/show_bug.cgi?id=2488304
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.json
FAQ
What is CVE-2026-50632?
CVE-2026-50632 is a vulnerability with a CVSS score of 8.1 (HIGH). A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrus...
How severe is CVE-2026-50632?
CVE-2026-50632 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-50632?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf.