All vulnerabilities
CVE-2026-50632GHSA-93g8-qqv3-mrx8

org.apache.cxf:cxf-rt-transports-jms: Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

Apache Software Foundation org.apache.cxf:cxf-rt-transports-jmsmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.12%Chance of exploitation activity in the next 30 days, higher than 65% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.2Also 4.1.7, 3.6.12GitHub
Published12 Jun 2026Updated 6 Oct 2026CVE List

What fixes it

  • 4.2.2org.apache.cxf:cxf-rt-transports-jms, mavenGitHub<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-transports-jms</artifactId><version>4.2.2</version></dependency>
  • 4.1.7org.apache.cxf:cxf-rt-transports-jms, mavenGitHub<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-transports-jms</artifactId><version>4.1.7</version></dependency>
  • 3.6.12org.apache.cxf:cxf-rt-transports-jms, mavenGitHub<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-transports-jms</artifactId><version>3.6.12</version></dependency>
  • 4.2.2Apache CXFCVE List
  • 4.1.7Apache CXFCVE List
  • 3.6.12Apache CXFCVE List
Show all 9 fixed versions
  • 4.2.2org.apache.cxf:cxf-rt-transports-jms, MavenOSV<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-transports-jms</artifactId><version>4.2.2</version></dependency>
  • 4.1.7org.apache.cxf:cxf-rt-transports-jms, MavenOSV<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-transports-jms</artifactId><version>4.1.7</version></dependency>
  • 3.6.12org.apache.cxf:cxf-rt-transports-jms, MavenOSV<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-transports-jms</artifactId><version>3.6.12</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Text from CVE List

Affected versions 68

  • org.apache.cxf:cxf-rt-transports-jms, maven>= 4.2.0, < 4.2.2GitHub
  • org.apache.cxf:cxf-rt-transports-jms, maven>= 4.1.0, < 4.1.7GitHub
  • org.apache.cxf:cxf-rt-transports-jms, maven< 3.6.12GitHub
  • Apache CXFaffected: 4.2.0 before 4.2.2CVE List
  • Apache CXFaffected: 4.0.0 before 4.1.7CVE List
  • Apache CXFaffected: all versions before 3.6.12CVE List
  • org.apache.cxf:cxf-rt-transports-jms, Mavenfrom 4.2.0, fixed in 4.2.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.2.0OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.2.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Mavenfrom 4.1.0, fixed in 4.1.7OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.0OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.3OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.4OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.5OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven4.1.6OSV
  • org.apache.cxf:cxf-rt-transports-jms, Mavenfrom first release, fixed in 3.6.12OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.10OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.11OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.12OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.13OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.6OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.7OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.8OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.0.9OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.10OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.3OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.4OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.5OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.6OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.7OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.8OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.1.9OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.10OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.11OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.12OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.3OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.4OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.5OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.6OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.7OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.8OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.2.9OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.0OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.10OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.11OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.3OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.4OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.5OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.6OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.7OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.8OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.3.9OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.4.0OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.4.1OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.4.10OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.4.2OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.4.3OSV
  • org.apache.cxf:cxf-rt-transports-jms, Maven2.4.4OSV

References 7