The vulnerability arises from an incomplete fix to CVE-2025-48913, which originally allowed remote code execution when untrusted users could configure JMS for Apache CXF. The remaining code path permits the execution of arbitrary code, and the issue is classified as a CWE-20 input validation weakness.

Affected products are Apache CXF versions older than the fixes released in 4.2.1, 4.1.6, and 3.6.11. If a system continues to run any earlier version, it remains susceptible to exploitation until it is upgraded to one of these patched releases.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score is 7.5, indicating a substantial risk. The risk remains significant because the flaw permits remote code execution if an attacker is able to supply or modify a JMS configuration. The attack likely requires some level of privilege or access to the configuration interface; once achieved, arbitrary code can run with the privileges of the CXF process.