CVE-2026-44417: Apache CXF JMS Configuration Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-44417: Apache CXF: Untrusted JMS configuration can lead to RCE. Affects org.apache.cxf:cxf-rt-transports-jms across 3 version ranges.
< 3.6.11
>= 4.1.0, < 4.1.6
>= 4.2.0, < 4.2.1
Fixed in 3.6.11, 4.1.6 or 4.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is a popular framework for building web services in Java. It provides a range of features for creating and consuming web services, including support for various transport protocols. The framework is widely used in enterprise applications due to its flexibility and ease of integration. However, a vulnerability in its JMS (Java Message Service) configuration can expose applications to serious security risks, particularly if untrusted users are allowed to configure JMS settings.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous issue (CVE-2025-48913) related to untrusted JMS configuration in Apache CXF. This oversight allows untrusted users to potentially execute arbitrary code by manipulating JMS settings. The implications of this vulnerability are severe, as it could lead to unauthorized access and control over the affected application, resulting in data breaches or service disruptions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.6.113.6.11 -
>= 4.1.0, < 4.1.64.1.6 -
>= 4.2.0, < 4.2.14.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting access to JMS configuration settings to trusted users only. This can help mitigate the risk of untrusted users exploiting the vulnerability until a proper update can be applied.
Conclusion
In summary, CVE-2026-44417 poses a significant risk to applications using Apache CXF if untrusted users can configure JMS settings. It is crucial to upgrade to the patched versions to mitigate this vulnerability and ensure the security of your applications.
See every vulnerability recorded for org.apache.cxf:cxf-rt-transports-jms →
FAQ
CVE-2026-44417 is a vulnerability in Apache CXF that allows untrusted users to configure JMS settings, potentially leading to remote code execution.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without needing to sign up.
The risks include unauthorized access to the application, potential data breaches, and the ability for attackers to execute arbitrary code on the server.
The safe versions to use are 4.2.1, 4.1.6, or 3.6.11, which contain fixes for this vulnerability.
You can update your dependency in the pom.xml file by specifying the fixed version in the <version> tag for the cxf-rt-transports-jms package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-rt-transports-jms.
