Critical severity · published Aug 8, 2025
CVE-2025-48913
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities
9.8
CVSS
1%
EPSS
No
On KEV
Description
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.
Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
before 3.6.8; 4.0.0 before 4.0.9; 4.1.0 before 4.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48913
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-48913
Mailing List
https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/08/07/2
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository