[CVE-2026-50633] A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can…

Descripción técnica

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Puntuación CVSS

Score: 8.1/10 — Severidad: HIGH — Estado NIST: Modified

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Cxf — Apache

Debilidades (CWE)

CWE-20, CWE-502

Fuente oficial

Publicado en NIST NVD.