The vulnerability arises from an incomplete fix to CVE-2025-48913, which originally allowed remote code execution when untrusted users could configure JMS for Apache CXF. The remaining code path permits the execution of arbitrary code, and the issue involves both a configuration management weakness (CWE‑15) and an input validation weakness (CWE‑20).

Affected products are Apache CXF versions older than the fixes released in 4.2.1, 4.1.6, and 3.6.11. If a system continues to run any earlier version, it remains susceptible to exploitation until it is upgraded to one of these patched releases.

The EPSS score is 0.00153 (less than 1%), indicating a very low but non‑zero probability of exploitation in the wild. Despite this, the CVSS score of 7.5 signals significant risk. The flaw permits remote execution when an attacker can supply or modify a JMS configuration. Attack may require access to the configuration interface or some level of privilege; once achieved, arbitrary code can execute with the privileges of the CXF process. The vulnerability is not listed in the CISA KEV catalog.