CVE-2026-44417General(apache / cxf)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache cxf systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o

Other references

Weakness type (CWE)

CWE-20CWE-15

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-06-12); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

apache

Products

cxf

1 version affected across 1 product

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

General

240.0%

Disclosure

240.0%

Patch

120.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-22	1	General1
2026-05-23	1	Disclosure1
2026-06-12	2	General1Patch1
2026-07-20	1	Disclosure1

Full discourse5 posts

Open Source Security mailing list@oss_security140d
Disclosure
Apache CXF CVE-2026-44417: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE https://www.openwall.com/lists/oss-security/2026/05/22/7 CVE-2026-44618: XXE in WS-Transfer functionality https://www.openwall.com/lists/oss-security/2026/05/22/8 CVE-2026-44930: LDAP Injection in XKMS LDAP Repository https://www.openwall.com/lists/oss-security/2026/05/22/9
Post summary
A set of new Apache CXF CVEs are disclosed, detailing RCE, XXE, and LDAP injection vulnerabilities, but no PoC, exploit code, or active exploitation evidence is presented.
010511.2K
4.7K followersView on X
VulniPulse@vulnipulse82d
Disclosure
⚠️ NetApp Active IQ Unified Manager for Linux alert: CVE-2026-44417 (CVSS 7.5) Attackers could disrupt service or cause a denial of service. No workaround is available; follow the vendor advisory for updates. https://vulnipulse.com/advisories/netapp-ntap-20260618-0002 #NetApp #CyberSecurity #CVE
Post summary
A warning about NetApp Active IQ Unified Manager for Linux (CVE‑2026‑44417) that can cause denial of service, with no workaround and a call to monitor vendor updates.
0000044
6 followersView on X
Upwind Security MDR@UpwindMDR120d
Patch
🚨Critical - Apache CXF JNDI Injection in JMSConfigFactory (CVE-2026-50632) This is yet another incomplete-fix follow-up in the Apache CXF JMS RCE saga (after CVE-2025-48913 and CVE-2026-44417). If an application lets untrusted users configure JMS settings for CXF, an attacker can supply a malicious JNDI lookup URL through JMSConfigFactory and trigger remote code execution. The risk only applies where JMS configuration is exposed to untrusted input, but where it is, the impact is full code execution on the server. Note GitHub rates this CVSS 9.8 while Apache's own advisory rates it moderate. 👉Upgrade to Apache CXF 4.2.2 or 4.1.7.
Post summary
The post announces a critical JNDI injection flaw in Apache CXF JMSConfigFactory, warns of remote code execution risk, and recommends upgrading to patched versions.
0000072
216 followersView on X
CVE@CVEnew120d
General
CVE-2026-50632 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code… https://www.cve.org/CVERecord?id=CVE-2026-50632
Post summary
The snippet highlights an incomplete fix for a previously disclosed CVE that allows remote code execution in Apache CXF, but it provides no PoC, exploit code, active exploitation evidence, or specific patch details.
00000174
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds141d
General
CVE-2026-44417 CVE-2026-44417 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44417
Post summary
The text merely repeats the CVE ID twice and links to a vulnerability database, offering no further details about the vulnerability, exploitation, or mitigation.
0000068
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	cxf	-	-	-
App	apache	cxf	4.2.0	-	-

Explore more

Back to dashboard apache CVEs cxf vulnerabilities

What researchers are saying

CVE-2026-44417

VulniPulse[verified]@vulnipulseDisclosure

A warning about NetApp Active IQ Unified Manager for Linux (CVE‑2026‑44417) that can cause denial of service, with no workaround and a call to monitor vendor updates.

Upwind Security MDR[verified]@UpwindMDRPatch

The post announces a critical JNDI injection flaw in Apache CXF JMSConfigFactory, warns of remote code execution risk, and recommends upgrading to patched versions.

Open Source Security mailing list@oss_securityDisclosure

A set of new Apache CXF CVEs are disclosed, detailing RCE, XXE, and LDAP injection vulnerabilities, but no PoC, exploit code, or active exploitation evidence is presented.

CVE@CVEnewGeneral

The snippet highlights an incomplete fix for a previously disclosed CVE that allows remote code execution in Apache CXF, but it provides no PoC, exploit code, active exploitation evidence, or specific patch details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text merely repeats the CVE ID twice and links to a vulnerability database, offering no further details about the vulnerability, exploitation, or mitigation.