7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44417

CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44417

CVE-2026-44417:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.cxf:cxf-rt-transports-jms	maven	= 4.2.0	4.2.1
org.apache.cxf:cxf-rt-transports-jms	maven	>= 4.1.0, < 4.1.6	4.1.6
org.apache.cxf:cxf-rt-transports-jms	maven	< 3.6.11	3.6.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a bypass of a previous security fix for JNDI injection (CVE-2025-48913) in Apache CXF's JMS transport. The initial fix introduced a JndiHelper class to validate JNDI configuration properties, specifically to restrict the protocols allowed in the JNDI provider URL. However, this fix was not applied to all code paths where a JNDI InitialContext was being created.

The analysis of the patch for CVE-2026-44417, specifically commit b22a80b341bf7e24d2df6cb95a6e01e78d3ff7aa, reveals that the createInitialContext method within the org.apache.cxf.transport.jms.util.AbstractMessageListenerContainer class was one such unsecured path. Before the patch, this method would instantiate a new InitialContext(this.jndiEnvironment) directly, without any validation of the provided properties. This allowed an attacker who could influence the JMS configuration to point to a malicious JNDI server (e.g., LDAP) and achieve remote code execution.

The patch remediates this by modifying AbstractMessageListenerContainer.createInitialContext to use the JndiHelper class. The constructor of JndiHelper performs the necessary validation on the java.naming.provider.url property, ensuring that only allowed protocols are used. This change effectively closes the previously missed attack vector. The added test case testJndiForbiddenProtocolForPollingContainer explicitly confirms that using a forbidden protocol like LDAP now results in an IllegalArgumentException, demonstrating the effectiveness of the fix.

Vulnerable functions

org.apache.cxf.transport.jms.util.AbstractMessageListenerContainer.createInitialContext

rt/transports/jms/src/main/java/org/apache/cxf/transport/jms/util/AbstractMessageListenerContainer.java

The function `createInitialContext` in `AbstractMessageListenerContainer` is vulnerable because it creates a `javax.naming.InitialContext` directly from the `jndiEnvironment` properties. If an attacker can control these properties, they can specify a malicious JNDI provider URL (e.g., via LDAP) which can lead to JNDI injection and remote code execution. The patch fixes this by using the `JndiHelper` class, which validates the protocol of the JNDI provider URL in its constructor, thus preventing the use of unsafe protocols.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.