PatchRadar

← Browse

CVE-2026-50633

Medium

Elevated severity or exploit probability.

CVSS base
8.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
1.3%
68.5th percentile
CISA KEV
Not listed
Weakness / dates
CWE-502
Published 2026-06-12 · modified 2026-08-07

Description

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected

apache

References

Official: NVD · CVE.org