CVE-2026-50632

EUVD-2026-36400
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachecxf
4.2.0 ≤
𝑥
< 4.2.2
CNA
apachecxf
𝑥
< 4.1.7
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw