Description
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | >= 4.2.0, < 4.2.1; >= 4.0.0, < 4.1.6; < 3.6.11 |
| Red Hat | Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | — |
| Red Hat | Red Hat Fuse 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — |
| Red Hat | Red Hat Single Sign-On 7 | — |
References
- https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4oMailing List, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/security/cve/CVE-2026-44417
- https://bugzilla.redhat.com/show_bug.cgi?id=2480729
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json
Timeline
- Published
- May 22, 2026
- Last modified
- Jul 23, 2026
- NVD status
- Modified