CVE-2026-44417

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

CVSS 7.5 HIGHEPSS 0.6%CWE-15 CWE-20

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.5EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

22 may 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Apache Software Foundation · Apache CXF

Referencias

https://access.redhat.com/security/cve/CVE-2026-44417 https://bugzilla.redhat.com/show_bug.cgi?id=2480729 https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json