PT-2026-42753

CVE-2026-44417

Published

2026-05-22

Updated

2026-10-13

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11

Description An incomplete fix for a previous issue allows for remote code execution if untrusted users are permitted to configure the Java Message Service (JMS), a Java API that allows applications to create, send, receive, and read messages.

Recommendations Upgrade to version 4.2.1. Upgrade to version 4.1.6. Upgrade to version 3.6.11.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-15: External Control of System or Configuration Setting

CWE-20: Improper Input Validation

Related identifiers