CVE-2026-66909
Received Received - Intake

Java Deserialization Flaw in Apache CXF JMS Transport

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-66909
EUVD
EUVD-2026-53854

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
apache cxf 4.2.3
apache cxf 4.1.8
apache cxf 3.6.12
apache cxf From 4.2.3 (inc)
apache cxf From 4.1.8 (inc)
apache cxf From 3.6.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache CXF's JMS transport deserializes JMS ObjectMessage bodies using Java deserialization without type restrictions. Attackers can send malicious serialized objects to cause denial of service or remote code execution if a gadget class exists on the classpath. The vulnerability is fixed by disabling ObjectMessage deserialization by default in versions 4.2.3, 4.1.8, or 3.6.12.

Detection Guidance

To detect this vulnerability, check if Apache CXF's JMS transport is enabled and if ObjectMessage deserialization is active. Inspect configuration files for JMS transport settings and look for any custom gadget classes that could be exploited. Monitor JMS message queues for unexpected serialized objects or unusual traffic patterns.

Impact Analysis

An attacker could exploit this to crash the service (denial of service) or execute arbitrary code remotely if vulnerable gadget classes are present. This requires the attacker to have access to the JMS destination to send malicious messages.

Compliance Impact

This vulnerability could lead to remote code execution or denial of service if exploited, potentially compromising data confidentiality and integrity. For GDPR, this may result in unauthorized access to personal data, triggering breach notification requirements. Under HIPAA, it could expose protected health information, violating security rules and requiring corrective action.

Mitigation Strategies

Immediately upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12. Disable JMS ObjectMessage deserialization by default unless explicitly required. If re-enabling is necessary, apply strict type restrictions and validate all incoming serialized objects. Isolate JMS endpoints to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart