PT-2026-48852 · Apache · Apache Cxf

CVE-2026-50633

·

Published

2026-06-12

·

Updated

2026-08-07

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7
Description A JNDI Injection issue exists in the JCA integration module. This occurs when an attacker can manipulate the JCA deployment descriptor ('ra.xml') or runtime activation parameters, potentially leading to remote code execution. JNDI (Java Naming and Directory Interface) is an API that allows applications to discover and look up data and objects via different naming and directory services.
Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Exploit

Fix

DoS

Deserialization of Untrusted Data

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502CWE-20

Related Identifiers

CVE-2026-50633
GHSA-QP3F-RVJ8-46C8

Affected Products

Apache Cxf