CVE-2026-50632: Apache CXF remote code execution in JMS configuration

CVE-2026-50632 · Severity: critical · CVSS 9.8 · Published 2026-06-12

Apache CXF is a widely-used web services framework that supports Java Message Service (JMS) as a transport mechanism for distributed communication. A vulnerability in its JMS configuration component allows attackers with the ability to configure JMS settings to execute arbitrary code on the server. This is an incomplete fix for a previous vulnerability (CVE-2026-44417), and successful exploitation could result in complete system compromise and full access to sensitive data.

Technologies: org.apache.cxf:cxf-rt-transports-jms (Maven), Red Hat Single Sign-On 7. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-50632 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50632 being exploited in the wild.
How severe is CVE-2026-50632?
Critical severity, with a CVSS score of 9.8, published 12 June 2026.
Which products and versions are affected?
org.apache.cxf:cxf-rt-transports-jms (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.2.
Is there a fix for CVE-2026-50632?
Yes. org.apache.cxf:cxf-rt-transports-jms (Maven): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50632 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50632?
Check whether you run org.apache.cxf:cxf-rt-transports-jms (Maven), Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.cxf:cxf-rt-transports-jms (Maven): upgrade to 4.2.2 or later
    # set org.apache.cxf:cxf-rt-transports-jms to 4.2.2 in your pom.xml or build.gradle

Technical details

The vulnerability stems from improper input validation and unsafe deserialization of untrusted data in the JMS configuration factory component of Apache CXF (CWE-20, CWE-502). The root cause is an incomplete fix for the prior RCE vulnerability CVE-2026-44417. An attacker who can provide or control JMS configuration parameters can inject arbitrary JNDI lookup strings, leading to remote code execution through gadget chain exploitation or JNDI reference manipulation. The attack vector is network-based with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8). Patches are available in Apache CXF versions 4.2.2 and 4.1.7; users should upgrade immediately. Red Hat has released patches via multiple RHSA advisories including RHSA-2026:37390, RHSA-2026:70228, and others for affected products such as Red Hat Fuse, JBoss EAP, and related platforms.

Affected products

  • Apache CXF < 4.1.7, >= 4.2.0 and < 4.2.2
  • Red Hat Fuse
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Single Sign-On 7

Identifiers

  • CVE-2026-50632
  • GHSA-93g8-qqv3-mrx8

Timeline

  • 2026-06-12: disclosed: Vulnerability disclosed; CVE-2026-50632 published
  • 2026-06-12: patched: Patches available: Apache CXF 4.2.2 and 4.1.7
  • 2026-06-12: advisory: GHSA-93g8-qqv3-mrx8 advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.