Executive brief
Apache CXF is a widely-used web services framework that supports Java Message Service (JMS) as a transport mechanism for distributed communication. A vulnerability in its JMS configuration component allows attackers with the ability to configure JMS settings to execute arbitrary code on the server. This is an incomplete fix for a previous vulnerability (CVE-2026-44417), and successful exploitation could result in complete system compromise and full access to sensitive data.
Technical details
The vulnerability stems from improper input validation and unsafe deserialization of untrusted data in the JMS configuration factory component of Apache CXF (CWE-20, CWE-502). The root cause is an incomplete fix for the prior RCE vulnerability CVE-2026-44417. An attacker who can provide or control JMS configuration parameters can inject arbitrary JNDI lookup strings, leading to remote code execution through gadget chain exploitation or JNDI reference manipulation. The attack vector is network-based with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8). Patches are available in Apache CXF versions 4.2.2 and 4.1.7; users should upgrade immediately. Red Hat has released patches via multiple RHSA advisories including RHSA-2026:37390, RHSA-2026:70228, and others for affected products such as Red Hat Fuse, JBoss EAP, and related platforms.
Affected products
- Apache CXF < 4.1.7, >= 4.2.0 and < 4.2.2
- Red Hat Fuse
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat Single Sign-On 7
Timeline
- 2026-06-12: disclosed: Vulnerability disclosed; CVE-2026-50632 published
- 2026-06-12: patched: Patches available: Apache CXF 4.2.2 and 4.1.7
- 2026-06-12: advisory: GHSA-93g8-qqv3-mrx8 advisory published