Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

Fix availableCritical · CVSS 9.8EPSS 1.1%

Published Jun 12, 2026 · updated Oct 6, 2026

What to do

  1. Upgrade to a fixed version: org.apache.cxf:cxf-rt-transports-jms 4.2.2, org.apache.cxf:cxf-rt-transports-jms 4.1.7, org.apache.cxf:cxf-rt-transports-jms 3.6.12.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.cxf:cxf-rt-transports-jms

Vulnerable versions
>= 4.2.0, < 4.2.2
Fixed in
4.2.2

Check your project: mvn dependency:tree -Dincludes=org.apache.cxf:cxf-rt-transports-jms

Mavenorg.apache.cxf:cxf-rt-transports-jms

Vulnerable versions
>= 4.1.0, < 4.1.7
Fixed in
4.1.7

Check your project: mvn dependency:tree -Dincludes=org.apache.cxf:cxf-rt-transports-jms

Mavenorg.apache.cxf:cxf-rt-transports-jms

Vulnerable versions
< 3.6.12
Fixed in
3.6.12

Check your project: mvn dependency:tree -Dincludes=org.apache.cxf:cxf-rt-transports-jms

Sources

CWE-20 Improper Input Validation · CWE-502 Deserialization of Untrusted Data

← All critical vulnerabilities