PT-2026-48851 · Apache · Apache Cxf

Osidb Bzimport

·

CVE-2026-50632

·

Published

2026-06-12

·

Updated

2026-08-07

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7
Description An incomplete fix for a previous issue allows untrusted users who can configure the Java Message Service (JMS), a Java API for creating, administering, and managing messaging systems, to achieve arbitrary code execution. This flaw can lead to a complete compromise of the affected system.
Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Exploit

Fix

RCE

DoS

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502CWE-20

Related Identifiers

CVE-2026-50632
GHSA-93G8-QQV3-MRX8

Affected Products

Apache Cxf