CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Critical 9.8 Published 6 Aug 2026 Updated 7 Aug 2026

Attackers can achieve remote code execution or denial of service by sending malicious JMS messages to Apache CXF services using unsafe Java deserialization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-66909?

CVE-2026-66909 is a critical unsafe deserialization vulnerability in Apache Cxf, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Weakness: CWE-502

Which versions are affected by CVE-2026-66909?

It affects 1 product.

Products include Apache Cxf.

How do I fix CVE-2026-66909?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-66909 being exploited?

There is no known exploitation of CVE-2026-66909 in the wild and no public exploit code.

All Apache Cxf vulnerabilities

Sources

Also known as CLEANSTART-2026-TK74523, GHSA-gvw8-rcrx-9fxx, RHLW-2026-03cce96257578d24.