CVE-2026-44417: Apache CXF remote code execution in JMS transport

CVE-2026-44417 · Severity: high · CVSS 7.5 · Published 2026-05-22

Apache CXF is a popular open-source framework used to build and develop web services. A security flaw exists where an attacker with the ability to configure Java Message Service (JMS) settings could execute malicious code on the server. This could lead to a complete takeover of the affected system and unauthorized access to sensitive data.

Technologies: Apache Software Foundation CXF, org.apache.cxf:cxf-rt-transports-jms (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-44417 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44417 being exploited in the wild.
How severe is CVE-2026-44417?
High severity, with a CVSS score of 7.5, published 22 May 2026.
Which products and versions are affected?
Apache Software Foundation CXF < 3.6.11, >= 4.1.0, < 4.1.6, 4.2.0, < 3.6.11, 4.0.0 to < 4.1.6, 4.2.0 to < 4.2.1; org.apache.cxf:cxf-rt-transports-jms (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.1.
Is there a fix for CVE-2026-44417?
Yes. org.apache.cxf:cxf-rt-transports-jms (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44417 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44417?
Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-transports-jms (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.cxf:cxf-rt-transports-jms (Maven): upgrade to 4.2.1 or later
    # set org.apache.cxf:cxf-rt-transports-jms to 4.2.1 in your pom.xml or build.gradle

Technical details

This vulnerability is a regression or incomplete fix for CVE-2025-48913 within the Apache CXF JMS transport component (cxf-rt-transports-jms). The root cause is improper input validation (CWE-20) when processing JMS configurations. If an attacker can provide or influence the JMS configuration used by CXF, they can trigger an alternative code path that leads to Remote Code Execution (RCE). Exploitation typically requires low privileges to modify configurations and a high complexity environment where such untrusted configurations are permitted. Patches are available in versions 3.6.11, 4.1.6, and 4.2.1.

Affected products

  • Apache Software Foundation Apache CXF < 3.6.11, 4.0.0 to < 4.1.6, 4.2.0 to < 4.2.1

Identifiers

  • CVE-2026-44417
  • GHSA-2hvc-5c6v-f533

Timeline

  • 2026-05-22: disclosed
  • 2026-05-22: advisory: Initial advisory published by Apache and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.