Loading vulnerability…
Remote code execution via untrusted JMS configuration in Apache CXF
CVE-2026-44417 is a remote code execution vulnerability in Apache CXF's cxf-rt-transports-jms component. An incomplete fix for CVE-2025-48913 leaves an alternative code path that may permit code execution when untrusted users are allowed to configure Java Message Service (JMS) settings. Successful exploitation can execute arbitrary code with the privileges of the affected service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An untrusted user with permission to configure JMS can potentially execute arbitrary code in the affected Apache CXF service's security context.
If you can’t patch tonight, do this now.
Restrict JMS configuration permissions to trusted users and protect configuration files and management interfaces controlling JMS settings. Disable JMS functionality where it is not required.
Patch, then assume compromise.
Upgrade Apache CXF to version 4.2.1, 4.1.6, or 3.6.11, as appropriate for the release branch, to address CVE-2026-44417. A subsequent incomplete-fix vulnerability, CVE-2026-50632, requires versions 4.2.2, 4.1.7, or 3.6.12. For Red Hat deployments, apply the applicable vendor update: RHSA-2026:37390 for the Apache Camel Spring Boot build, or the JBoss EAP 8.1.8 updates covered by RHSA-2026:70228, RHSA-2026:70229, and RHSA-2026:70230 for RHEL 8, 9, and 10 respectively.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.