CVE-2026-44417
Modified
Modified - Updated After Analysis
BaseFortify
Vulnerability report for CVE-2026-44417, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-05-22
Last updated on: 2026-06-30
Assigner: Apache Software Foundation
Description
Description
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | cxf | to 3.6.11 (exc) |
| apache | cxf | From 4.0.0 (inc) to 4.1.6 (exc) |
| apache | cxf | 4.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
