CVE-2026-50632

Modified Modified - Updated After Analysis

Remote Code Execution in Apache CXF via JMS Configuration

Publication date: 2026-06-12

Last updated on: 2026-07-02

Assigner: Apache Software Foundation

Description

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-07-02

Generated

2026-07-02

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-50632

EUVD

EUVD-2026-36400

Affected Vendors & Products

Vendor	Product	Version / Range
apache	cxf	to 4.1.7 (exc)
apache	cxf	From 4.2.0 (inc) to 4.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an incomplete fix related to a previous security issue (CVE-2026-44417) in Apache CXF. It involves untrusted JMS (Java Message Service) configuration, which can allow remote code execution (RCE) if untrusted users are permitted to configure JMS settings in Apache CXF.

Essentially, if an attacker can provide JMS configuration, they might execute arbitrary code on the system running Apache CXF.

Impact Analysis

This vulnerability can lead to remote code execution, which means an attacker could run malicious code on your system remotely if they are able to configure JMS in Apache CXF.

Such an impact could compromise the confidentiality, integrity, and availability of your system and data.

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade Apache CXF to versions 4.2.2 or 4.1.7, which contain the fix for this issue.

Additionally, ensure that untrusted users are not allowed to configure JMS for Apache CXF, as this can lead to remote code execution.

Compliance Impact

This vulnerability allows remote code execution (RCE) through untrusted JMS configuration in Apache CXF, which can lead to unauthorized access, data breaches, and system compromise.

Such security weaknesses can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system configurations to prevent unauthorized access and data loss.

Organizations using vulnerable versions of Apache CXF may face increased risk of non-compliance due to potential data confidentiality, integrity, and availability violations.

Upgrading to fixed versions (4.2.2 or 4.1.7) is recommended to mitigate these risks and help maintain compliance.

Hi! I’m here to help you understand CVE-2026-50632. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70