CVE-2026-66909 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JMS Transport deserialization

A vulnerability was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. It has been classified as critical. Impacted is an unknown function of the component JMS Transport. This manipulation causes deserialization.

This vulnerability is registered as CVE-2026-66909. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More