Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-66909
By Roy Kalfon |
7 August 2026
Apache CXF JMS transport unsafe ObjectMessage deserialization enables DoS and potential RCE
org.apache.cxf:cxf-rt-transports-jms deserializes inbound JMS ObjectMessage bodies via native Java deserialization without type restrictions, so any attacker who can publish to the JMS destination can trigger DoS or RCE via gadget classes on the classpath. Affected: < 3.6.12, `4.0.0-