PT-2026-48852 · Apache · Apache Cxf

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-50633

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7

Description A JNDI Injection issue exists in the JCA integration module. This occurs when an attacker can manipulate the JCA deployment descriptor ('ra.xml') or runtime activation parameters, potentially leading to remote code execution. JNDI (Java Naming and Directory Interface) is an API that allows applications to discover and look up data and objects via different naming and directory services.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-50633

Affected Products

Apache Cxf

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-50633 · Security Note
• https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2065386382474842201 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/11/10 · Note