CVE-2026-44417

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

CVSS 7.5 HIGHEPSS 0.6%CWE-15 CWE-20

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

22 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Apache Software Foundation · Apache CXF

Referências

https://access.redhat.com/security/cve/CVE-2026-44417 https://bugzilla.redhat.com/show_bug.cgi?id=2480729 https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json