CVE-2026-50633CWE-20CWE-502insecure-deserialization

CVE-2026-50633

High · published June 12, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
69.6
In the wild
Unconfirmed
What it is

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01271 · 69.6th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-06-12T14:16Z
Affected products (2)
ProductVersionsFixed in
apache/cxf< 4.1.74.1.7
apache/cxf≥ 4.2.0, < 4.2.24.2.2
References (6)
https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf · [email protected]http://www.openwall.com/lists/oss-security/2026/06/11/10 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2026:37390 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-50633 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2488307 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50633.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 12 JUN 09:02Z
    Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
    cvelistv5