CVE-2026-66909

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description The JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization without type restrictions. An attacker capable of placing a message on the service's JMS destination can submit a malicious serialized object. This can result in a denial of service or remote code execution if a suitable gadget class is present on the classpath. A gadget class is a piece of code already present in the application's environment that can be leveraged during deserialization to execute unintended actions.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.