Apache CXF Dual Critical Vulns: CVE-2026-66909 JMS Deserialization RCE Score 10, CVE-2026-68079 OAuth2 Auth Code Replay

Apache Software Foundation disclosed two CXF CVSS 9.8 vulns on Aug 6: CVE-2026-66909 JMS ObjectMessage deserialization RCE, CVE-2026-68079 OAuth2 auth code unlimited replay. Fixed in 3.6.12 / 4.1.8 / 4.2.3.

Apache Software Foundation published two high-severity Apache CXF advisories on August 6, 2026. CVE-2026-66909 patches a JMS transport-layer deserialization RCE, CVSS v3.1 9.8 (v2 10.0); CVE-2026-68079 patches an OAuth2 DefaultEncryptingCodeDataProvider unused-authorization-code replay issue, also 9.8. Both advisories hit Apache CXF main and LTS branches; fixed in 3.6.12, 4.1.8, 4.2.3.

Incident Overview

CVE-2026-66909 sits in CXF's JMS transport: any client-received `ObjectMessage` is handed straight to the native Java deserializer with no type whitelist. An attacker who can write to a JMS destination can deliver a crafted serialized object and, with a gadget chain on the ClassPath, trigger deserialization RCE. CVE-2026-68079 sits in CXF's OAuth2 module: `removeCodeGrant()` is broken and does not actually delete used authorization codes, so a captured code can be redeemed indefinitely. Neither vuln needs auth or user interaction.

Technical Details

• CVE-2026-66909: JMS ObjectMessage → `javax.jms.ObjectMessage.getObject()` → `ObjectInputStream.readObject()`; fix defaults ObjectMessage deserialization off, with an explicit switch for legacy apps.
• CVE-2026-68079: `DefaultEncryptingCodeDataProvider.removeCodeGrant` does not actually delete the auth code from backing store; RFC 6749 requires authorization codes "MUST be used only once".
• Affected: CXF 3.6.0 ~ 3.6.11, 4.0.0 ~ 4.1.7, 4.2.0 ~ 4.2.2.
• Fixed: 3.6.12 / 4.1.8 / 4.2.3. Official guidance: all users upgrade.
• Exploit bar: CVE-2026-66909 needs a writable message queue; CVE-2026-68079 needs a captured OAuth2 authorization code (typical: client logs, Referer, browser history, packet replay).

Impact Assessment

• CVSS 3.1: 9.8 (Critical), vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
• Real-world impact:

① CVE-2026-66909 — direct RCE on deployments with gadget classes (Apache Commons Collections/Spring, etc.); worst case, full Java process takeover. ② CVE-2026-68079 — one captured auth code is enough to abuse; breaks OAuth2 single-use, collapses the grant flow.

• Blast radius: CXF underpins Web services / SOAP / REST / JMS integration across finance, telecom, government, and SaaS. A CVSS 9.8 RCE is a serious threat to CXF-backed enterprise backends.
• Trend: Java deserialization stays near OWASP Top 10. Apache CXF already published similar-severity issues in H1 2026 (e.g. CVE-2026-50633 JNDI injection).

Remediation

• Upgrade now: Apache CXF 3.6.12 / 4.1.8 / 4.2.3 — covers all supported branches.
• JMS config: after upgrade, explicitly disable custom ObjectMessage deserialization; enable JMS endpoint encryption/signing; restrict to trusted Source.
• OAuth2 config: check auth-code storage backend (DB/cache); verify codes actually expire after a single redeem; enable PKCE (`code_challenge`) to mitigate replay.
• Defense in depth: block suspicious SOAP/JMS outbound at reverse proxy/WAF; set JVM deserialization filters on CXF services (JEP 290 / `-Djdk.serialFilter`) to stop common gadget chains.
• Credential rotation: if you granted access to trusted third-party apps and cannot confirm the auth code was not captured, revoke and rotate the corresponding OAuth2 Client credentials.
• Detection: watch CXF services for anomalous `ObjectInputStream` stacks; watch OAuth2 auth-code use count (>1 is suspicious).

References

• Apache CXF official advisory (CVE-2026-66909)
• Apache CXF official advisory (CVE-2026-68079)
• Tenable CVE-2026-66909 technical summary
• IONIX CVE-2026-68079 analysis