CVE-2026-50632
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
An incomplete fix for the previous advisory CVE-2026-44417 (Untrusted JMS configuration leading to RCE) in Apache CXF has been identified, allowing code execution if untrusted users can configure JMS. Users are advised to upgrade to versions 4.2.2 or 4.1.7.
Risk Assessment
The organization is at risk of remote code execution by an attacker who can configure JMS, potentially leading to system compromise and breach of data confidentiality, integrity, and availability.
Recommendation
Upgrade Apache CXF to versions 4.2.2 or 4.1.7 immediately, which contain the complete fix for this vulnerability.
Original NVD description (English source)
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.