AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-66909

CRITICAL · CVSS 9.8 EPSS 0.69% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-06 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

Apache CXF's JMS transport is vulnerable due to its use of native Java deserialization for inbound JMS ObjectMessages without type restrictions, allowing attackers to send malicious serialized objects. This can lead to denial of service or, if certain classes are present, remote code execution. Organizations using affected versions of Apache CXF should prioritize upgrading to versions 4.2.3, 4.1.8, or 3.6.12 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-66909
Severity
CRITICAL
CVSS
9.8
EPSS
0.69%
Apache Java

Original NVD Description

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Related CVEs

Other vulnerabilities affecting the same vendor(s)