CVE-2026-66909

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	>= 4.2.0, < 4.2.3; >= 4.0.0, < 4.1.8; < 3.6.12

References

https://lists.apache.org/thread/lr5d4tg6tf7j29jmw8wt242oowonjqpxMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/18

Timeline

Published: Aug 6, 2026
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-66917.8The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overfl CVE-2026-669115.3Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitiza CVE-2026-669125.3Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insu CVE-2026-669136.9Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a CVE-2026-669149.2Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could down CVE-2026-6691510.0Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by usin CVE-2026-669166.9Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated ac CVE-2026-669178.6Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any CVE-2026-669188.2Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the CVE-2026-669196.9Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from gr CVE-2026-66928.8The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and 'CVE-2026-669208.2Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms