Apache CXF’s JMS transport naïvely deserializes the body of any inbound JMS ObjectMessage using native Java deserialization without type checks. This flaw allows an attacker who can place a message on the service’s JMS destination to inject a malicious serialized object. Depending on the classpath contents, the payload can either trigger a denial‑of‑service or execute arbitrary code on the host. The presence of suitable gadget classes is a prerequisite for remote code execution but even without them a non‑replicated attacker can still crash the service by corrupting its state.

The issue affects installations of Apache CXF that rely on the JMS transport. The Apache Software Foundation has released mitigations in version 4.2.3, 4.1.8 and 3.6.12, which disable ObjectMessage deserialization by default and provide a configuration option to re‑enable it if required.

The EPSS score for this vulnerability is not available, and it is not listed in the CISA KEV catalog, so publicly documented exploitation data is missing. However, the opportunity to deliver a serialized payload via JMS is accessible when an application publishes or consumes messages, making the attack vector plausible in many deployments. Although an exact CVSS score is not supplied, the potential for remote code execution implies a high severity. Administrators should treat the vulnerability with urgency until a patch is available or a mitigation is applied.