CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
- Record
CVE-2026-66909- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-53854
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
- Record
EUVD-2026-53854- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gvw8-rcrx-9fxx
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native...
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
- Record
GHSA-gvw8-rcrx-9fxx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
- Record
CVE-2026-66909- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
- Record
CVE-2026-66909- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVRHLW-2026-03cce96257578d24
Lightwell Security Advisory: cxf-rt-transports-jms 4.2.2.rhlw-00007
Red Hat Lightwell has released org.apache.cxf:cxf-rt-transports-jms 4.2.2.rhlw-00007 with a backported security fix.
CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-transports-jms 4.2.2 from Maven Central.
- Record
RHLW-2026-03cce96257578d24- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHLW-2026-109b0867db5b9dde
Lightwell Security Advisory: cxf-rt-transports-jms 3.6.9.rhlw-00004
Red Hat Lightwell has released org.apache.cxf:cxf-rt-transports-jms 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909.
CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)
CVE-2026-50632: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-transports-jms 3.6.9 from Maven Central.
- Record
RHLW-2026-109b0867db5b9dde- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHLW-2026-689bba11eae91bcb
Lightwell Security Advisory: cxf-jaxrs-service 3.6.9.rhlw-00004
Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909.
CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)
CVE-2026-50632: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
This patched artifact is a drop-in replacement for org.apache.cxf.archetype:cxf-jaxrs-service 3.6.9 from Maven Central.
- Record
RHLW-2026-689bba11eae91bcb- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-transports-jmsRed Hat Lightwell:Maven |
4.2.2 up to 4.2.2.rhlw-00007 | 4.2.2.rhlw-00007 |
org.apache.cxf:cxf-rt-transports-jmsRed Hat Lightwell:Maven From an advisory covering 3 CVEs |
before 3.6.9.rhlw-00004, plus listed versions 2.0.102.0.112.0.122.0.132.0.6 Show 45 moreShow less2.0.72.0.82.0.92.12.1.12.1.102.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.22.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.22.4.32.4.4 |
3.6.9.rhlw-00004 |
org.apache.cxf.archetype:cxf-jaxrs-serviceRed Hat Lightwell:Maven From an advisory covering 3 CVEs |
before 3.6.9.rhlw-00004, plus listed versions 2.5.12.5.102.5.112.5.22.5.3 Show 45 moreShow less2.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone1 |
3.6.9.rhlw-00004 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-66909 is a critical vulnerability (CVSS 9.8) in Apache Cxf, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 66th percentile. Fixed in org.apache.cxf:cxf-rt-transports-jms 4.2.2.rhlw-00007.
References
lists.apache.org/thread/lr5d4tg6tf7j29jmw8wt242oowonjqpx
openwall.com/lists/oss-security/2026/08/06/18
nvd.nist.gov/vuln/detail/CVE-2026-66909
github.com/advisories/GHSA-gvw8-rcrx-9fxx
repo.maven.apache.org/maven2
Show 13 moreShow less
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44417.json
access.redhat.com/errata/RHSA-2026:37390
Left out here: 252 versions. The JSON record has them.