{"id":"CVE-2026-44417","state":"PUBLISHED","title":"Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)","description":"The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. \nUsers are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.","publishedAt":"2026-05-22T12:17:25.102Z","updatedAt":"2026-07-15T00:54:13.279Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache CXF"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache CXF","packageName":"org.apache.cxf:cxf-rt-transports-jms","defaultStatus":"unaffected","versions":[{"version":"4.2.0","status":"affected","lessThan":"4.2.1","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThan":"4.1.6","versionType":"semver"},{"version":"0","status":"affected","lessThan":"3.6.11","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o","https://access.redhat.com/security/cve/CVE-2026-44417","https://bugzilla.redhat.com/show_bug.cgi?id=2480729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json","https://access.redhat.com/errata/RHSA-2026:37390"],"weaknesses":["CWE-20","CWE-15"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44417.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44417","state":"PUBLISHED","datePublished":"2026-05-22T12:17:25.102Z","dateUpdated":"2026-07-15T00:54:13.279Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-05-06T14:29:28.897Z"},"containers":{"cna":{"title":"Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)","descriptions":[{"lang":"en","value":"The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. \nUsers are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache CXF","packageName":"org.apache.cxf:cxf-rt-transports-jms","defaultStatus":"unaffected","versions":[{"version":"4.2.0","status":"affected","lessThan":"4.2.1","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThan":"4.1.6","versionType":"semver"},{"version":"0","status":"affected","lessThan":"3.6.11","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-05-22T12:17:25.102Z"},"credits":[{"lang":"en","type":"finder","value":"Github / twitter - https://github.com/exploitintel / @exploit_intel"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-05-22T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-44417"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-23T03:55:40.449Z"}},{"title":"org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration","descriptions":[{"lang":"en","value":"A flaw was found in Apache CXF. Untrusted users, if allowed to configure Java Message Service (JMS) for Apache CXF, can exploit this vulnerability to achieve remote code execution (RCE). This issue arises from an incomplete fix for a prior security flaw, indicating an alternative path that could lead to code execution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16","packageName":"cxf-rt","defaultStatus":"affected","versions":[{"version":"transports-jms","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.18"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"cxf-rt-transports-jms","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"cxf-rt-transports-jms","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"cxf-rt-transports-jms","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"cxf-rt-transports-jms","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"cxf-rt-transports-jms","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-44417","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480729","name":"RHBZ#2480729","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-15","description":"External Control of System or Configuration Setting","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:54:13.279Z"},"datePublic":"2026-05-22T12:17:25.102Z","solutions":[{"lang":"en","value":"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}],"timeline":[{"lang":"en","time":"2026-05-22T13:00:55.251Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-22T12:17:25.102Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"To mitigate this issue, ensure that only trusted users have permissions to configure Java Message Service (JMS) for Apache CXF. Restrict access to configuration files and management interfaces that control JMS settings. If JMS functionality is not required, consider disabling it to remove the attack vector."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}