THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-50633 (HIGH 8.1) — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to version

[NVD] CVE-2026-50633 (HIGH 8.1) — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to version

lownvdPublished 2026-06-12

CVE-2026-50633 CVSS: 8.1 HIGH Published: 2026-06-12T10:16:23.297

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Indicators of compromise

CVE-2026-50633cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-50633