Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Summary

CVE	CVE-2026-44417
State	PUBLISHED
Assigner	apache
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-05-22 13:16:22 UTC
Updated	2026-07-15 02:21:52 UTC
Description	The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from ADP

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-20 | CWE-15 | CWE-20 CWE-20 Improper Input Validation | CWE-15 External Control of System or Configuration Setting

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	ADP	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Cxf	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Apache Software Foundation	Apache CXF	affected 4.2.0 4.2.1 semver	Not specified
CNA	Apache Software Foundation	Apache CXF	affected 4.0.0 4.1.6 semver	Not specified
CNA	Apache Software Foundation	Apache CXF	affected 3.6.11 semver	Not specified
ADP	Red Hat	Red Hat Build Of Apache Camel 4.18.1.P1 For Spring Boot 3.5.16	unaffected transports-jms * rpm	Not specified
ADP	Red Hat	Red Hat Fuse 7	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform 7	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform 8	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	Not specified	Not specified
ADP	Red Hat	Red Hat Single Sign-On 7	Not specified	Not specified

References

Reference	Source	Link	Tags
access.redhat.com/security/cve/CVE-2026-44417	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
access.redhat.com/errata/RHSA-2026:37390	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o	[email protected]	lists.apache.org	Mailing List, Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Github / twitter - https://github.com/exploitintel / @exploit_intel (en)

Additional Advisory Data

Source	Time	Event
ADP	2026-05-22T13:00:55.251Z	Reported to Red Hat.
ADP	2026-05-22T12:17:25.102Z	Made public.

Solutions

ADP: RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Workarounds

ADP: To mitigate this issue, ensure that only trusted users have permissions to configure Java Message Service (JMS) for Apache CXF. Restrict access to configuration files and management interfaces that control JMS settings. If JMS functionality is not required, consider disabling it to remove the attack vector.

There are currently no legacy QID mappings associated with this CVE.