Executive brief
Apache CXF is a popular open-source framework used to build and develop web services. A security flaw exists where an attacker with the ability to configure Java Message Service (JMS) settings could execute malicious code on the server. This could lead to a complete takeover of the affected system and unauthorized access to sensitive data.
Technical details
This vulnerability is a regression or incomplete fix for CVE-2025-48913 within the Apache CXF JMS transport component (cxf-rt-transports-jms). The root cause is improper input validation (CWE-20) when processing JMS configurations. If an attacker can provide or influence the JMS configuration used by CXF, they can trigger an alternative code path that leads to Remote Code Execution (RCE). Exploitation typically requires low privileges to modify configurations and a high complexity environment where such untrusted configurations are permitted. Patches are available in versions 3.6.11, 4.1.6, and 4.2.1.
Affected products
- Apache Software Foundation Apache CXF < 3.6.11, 4.0.0 to < 4.1.6, 4.2.0 to < 4.2.1
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory: Initial advisory published by Apache and NVD