CVE-2026-50633
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters.
Risk Assessment
The risk for the organization is the possibility of remote code execution by an attacker, potentially leading to server takeover and compromise of data confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately upgrade Apache CXF to versions 4.2.2 or 4.1.7, which fix this vulnerability.
Original NVD description (English source)
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.