November 13, 2026

CVE Watchtower

CVE-2025-48913Apache Cxf Improper Input Validation

NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vulnerability Summary

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Severity Level
CRITICAL(9.8)
Published Date
Aug 8, 2025
Last Modified
Aug 14, 2025
Exploitation Status
No confirmed exploitation yet
Root Weakness (CWE)
CWE-20: Improper Input Validation β†—
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required.
CVSS v3.1 Base Metrics — Score 9.8 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Apache Cxf < 3.6.8
  • Apache Cxf >= 4.0.0 and < 4.0.9
  • Apache Cxf >= 4.1.0 and < 4.1.3
Patched Versions
  • Apache Cxf 3.6.8
  • Apache Cxf 4.0.9
  • Apache Cxf 4.1.3

What to do

Plan remediation soon. No exploitation is confirmed yet, but the severity is critical.

  1. Check whether you run Apache Cxf and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Aug 8, 2025Published
  • Aug 14, 2025Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Apache Cxf CVEsYou are reading CVE-2025-48913. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

Related Coverage

More Apache Cxf CVEs

External References

Data last checked: Nov 13, 2026 21:28 UTC