VYPR
← All advisories
High severity8.1NVD Advisory· Published Jun 12, 2026· Updated Jun 12, 2026

CVE-2026-50633

CVE-2026-50633

Description

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Cxf2 versions
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <4.1.7
    • (no CPE)range: <4.1.7, <4.2.2

Patches

Vulnerability mechanics

References

2

News mentions

1