CVE-2026-50632CWE-20CWE-502insecure-deserialization

CVE-2026-50632

High · published June 12, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01116 · 65.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-06-12T14:16Z
Affected products (2)
ProductVersionsFixed in
apache/cxf< 4.1.74.1.7
apache/cxf≥ 4.2.0, < 4.2.24.2.2
References (5)
https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw · [email protected]https://access.redhat.com/errata/RHSA-2026:37390 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-50632 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2488304 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 12 JUN 09:00Z
    Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
    cvelistv5