Apache CXF JMS Transport Vulnerability with Deserialization Risks

CVE-2026-66909

What is CVE-2026-66909?

The Apache CXF JMS transport suffers from a serious deserialization vulnerability due to its handling of inbound JMS ObjectMessage. The component deserializes message bodies using unregulated Java deserialization methods, leaving it open to potential exploitation. An attacker capable of submitting a message to the JMS destination can inject malicious serialized objects into the system, potentially resulting in denial of service or, in cases where specific gadget classes are present, enabling remote code execution. To mitigate this risk, the default behavior has been changed to disable ObjectMessage deserialization, and users are strongly advised to update to the latest versions, specifically 4.2.3, 4.1.8, or 3.6.12, to secure their systems against this vulnerability.

References