CVE-2026-47323: Unauthenticated RCE in Apache Camel CXF Endpoints, Affects 3.18–4.18 Series

Apache Camel integration framework disclosed a CVSS 9.8 critical RCE, CVE-2026-47323. An unauthenticated attacker can inject Camel internal headers over HTTP to trigger arbitrary file write and code execution. Check Point published IPS signatures. Affected versions: 3.18.0–4.14.5 and 4.15.0–4.18.1. Official fixes: 4.14.6 and 4.18.2.

CVE-2026-47323 is a critical remote code execution (RCE) vulnerability in the Apache Camel integration framework. CVSS v3.1: 9.8. Low attack complexity. No privileges required. Remotely triggerable over the network. Root cause: with CXF-RS or CXF-SOAP endpoints enabled, some HTTP header fields can inject Camel internal headers without strict validation, triggering arbitrary file write or remote code execution. Affects widely used Apache Camel 3.x and 4.x versions. Check Point published corresponding IPS signatures on Security Gateway on August 23.

Incident Overview

Apache Camel is an enterprise integration framework. Used for SOAP/REST orchestration, message routing, protocol translation, and microservice integration. Common in finance, telecom, e-commerce, and government/enterprise service buses. After disclosure, Check Point tagged CVE-2026-47323 IPS protection as Web Server Enforcement Violation, available on R81/R80/R77/R75 Security Gateways. Camel is ubiquitous in enterprise integration stacks. CXF endpoints typically listen on HTTP. Potential impact surface is broad.

Technical Details

When Apache Camel handles HTTP requests received via CXF-RS or CXF-SOAP endpoints, it maps request headers to Camel Message Headers. CVE-2026-47323: certain reserved header fields do not strictly validate external input. An attacker can inject Camel-internal headers that control subsequent routing (e.g. CamelFileName, CamelFileContent) into the HTTP request. When a Camel route uses those headers for file write or script execution, the attacker obtains arbitrary file write or code execution. The chain requires no authentication and no user interaction. Fully automatable.

Impact Assessment

CVSS: 9.8 (Critical). Attack vector: network. Attack complexity: low. Privileges required: none. User interaction: none. PoC status: Check Point IPS signatures published—equivalent to public exploit conditions being met. Known in-the-wild: no 0day exploitation observed. Check Point classified it as Web Server Enforcement Violation; scan and exploit windows are shrinking fast. Impact surface: all applications using Camel 3.18.0–4.14.5 or 4.15.0–4.18.1 that expose CXF-RS / CXF-SOAP endpoints.

Affected Scope and Versions

• Apache Camel 3.18.0 and later, all 3.x series and 4.x before 4.14.6
• Apache Camel 4.15.0 and later, all 4.x series before 4.18.2
• Trigger: camel-cxf component enabled and HTTP endpoint exposed
• Official fixes: 4.14.6 (4.x mainline), 4.18.2 (4.x latest branch)

Remediation

• Immediately inventory Apache Camel versions and deployment forms in the application stack. Locate every node with the CXF component enabled.
• Priority P0: upgrade all affected services to 4.14.6 or 4.18.2. Validate route config and message-header handling in a test environment first.
• Priority P1: deploy CVE-2026-47323 protections on the WAF or API gateway. Explicitly strip or block suspicious Camel internal headers in HTTP requests (CamelFileName, CamelFileContent, CamelBeanMethod, etc.).
• Enable Check Point IPS signature Web Server Enforcement Violation – Apache Camel Remote Code Execution (CVE-2026-47323)
• Temporary mitigation: restrict CXF endpoints to trusted networks only. Disable or add authentication to endpoints that are not required.
• Detection: monitor unexpected file creation, scheduled-task changes, shell process spawns, and web-service processes calling curl/wget as unexpected children on application nodes.
• After the patch lands, review access logs from the patch window. Confirm no exploit attempts.

Detection Rules

• Treat Camel internal reserved headers (CamelFileName, CamelFileContent, etc.) in HTTP requests as suspicious
• Alert on CXF endpoint logs with abnormal request-header length or unconventional characters
• Application process spawns non-business children: shell, curl, wget, powershell
• Unexpected executables or scheduled tasks under the application working directory

Apache Camel is a core enterprise-integration component. Build a component-level asset inventory with dependency scanners (OWASP Dependency-Check, Snyk, Maven dependency:tree). Services exposing CXF endpoints should complete assessment and patch deployment within 24 hours.

References

• Check Point Advisories: Apache Camel Remote Code Execution (CVE-2026-47323)
• Enigma Global: Daily Threat Intelligence Digest 2026-08-23
• CVE Brief: August 23 2026 daily summary