PT-2026-48852

CVE-2026-50633

Published

2026-06-12

Updated

2026-08-07

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7

Description A JNDI Injection issue exists in the JCA integration module. This occurs when an attacker can manipulate the JCA deployment descriptor ('ra.xml') or runtime activation parameters, potentially leading to remote code execution. JNDI (Java Naming and Directory Interface) is an API that allows applications to discover and look up data and objects via different naming and directory services.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-502: Deserialization of Untrusted Data

Related identifiers

CVE-2026-50633