PT-2026-48851

CVE-2026-50632

Published

2026-06-12

Updated

2026-10-13

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7

Description An incomplete fix for a previous issue allows untrusted users who can configure the Java Message Service (JMS), a Java API for creating, administering, and managing messaging systems, to achieve arbitrary code execution. This flaw can lead to a complete compromise of the affected system.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

CWE-20: Improper Input Validation

Related identifiers