CVE-2026-50633

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/11/10	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/security/cve/CVE-2026-50633
https://bugzilla.redhat.com/show_bug.cgi?id=2488307
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50633.json

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección JNDI ha sido descubierta en el módulo de integración JCA de Apache CXF, que puede permitir la ejecución de código, si un atacante es capaz de manipular el descriptor de despliegue JCA (ra.xml) o los parámetros de activación en tiempo de ejecución. Se recomienda a los usuarios actualizar a las versiones 4.2.2 o 4.1.7, que corrige este problema.

Information

Published : 2026-06-12 10:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-50633

Mitre link : CVE-2026-50633

CVE.ORG link : CVE-2026-50633

JSON object : View

Products Affected

apache

cxf

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-50633", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50633", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-12T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.2", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.7", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-integration-jca", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "versions": [{"status": "unaffected", "version": "integration-jca", "lessThan": "*", "versionType": "rpm"}], "packageName": "cxf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "cxf-integration-jca", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "cxf-integration-jca", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-06-12T10:16:23.297", "references": [{"url": "https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/11/10", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2026:37390", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-50633", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488307", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50633.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters.\u00a0Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n JNDI ha sido descubierta en el m\u00f3dulo de integraci\u00f3n JCA de Apache CXF, que puede permitir la ejecuci\u00f3n de c\u00f3digo, si un atacante es capaz de manipular el descriptor de despliegue JCA (ra.xml) o los par\u00e1metros de activaci\u00f3n en tiempo de ejecuci\u00f3n. Se recomienda a los usuarios actualizar a las versiones 4.2.2 o 4.1.7, que corrige este problema."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0505632-D713-4EFC-B857-12EBD5C3DF33", "versionEndExcluding": "4.1.7"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1BF06FC-96AD-4663-9959-1B1493D4A2A0", "versionEndExcluding": "4.2.2", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}