CVE-2026-50632
HIGH severity · CVSS 8.1 · Improper input validation
8.1CVSS HIGH
Summary
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)1%
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products we track (2)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcwAdvisory
- https://access.redhat.com/errata/RHSA-2026:37390Advisory
- https://access.redhat.com/security/cve/CVE-2026-50632Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488304Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.jsonAdvisory