CVE-2026-66909

CVE-2026-66909 — Apache CXF JMS transport deserialization : The JMS transport deserializes the body of inbound ObjectMessage using native Java deserialization with no type restrictions, enabling an attacker who can place a message on the JMS destination to submit a malicious serialized object. Th...