What is the CVSS score of CVE-2026-50633?

CVE-2026-50633 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache CXF are affected by CVE-2026-50633?

Apache CXF's JCA integration module (versions 4.2.0-4.2.1 and 4.1.0-4.1.6) contains a high-severity remote code execution vulnerability allowing attackers to execute arbitrary code through deployment…. A patch is available.

How to fix or mitigate CVE-2026-50633?

Within 24 hours: Inventory all systems running Apache CXF 4.2.0-4.2.1 or 4.1.0-4.1.6, assess exposure, and create patch deployment plan. Within 7 days: Apply upgrades to Apache CXF 4.2.2 or later (for 4.2.x branch) and 4.1.7 or later (for 4.1.x branch) in test environments and validate functionality. Within 30 days: Complete production deployment of patched versions across all systems and verify successful upgrades.

Apache CXF CVE-2026-50633

EUVD-2026-36401 HIGH

Improper Input Validation (CWE-20)

2026-06-11

GHSA-qp3f-rvj8-46c8

Apache RCE Cxf

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires attacker control of ra.xml or activation parameters (admin-level artifacts), so PR:H and AC:H; RCE in the app-server JVM crosses the resource-adapter trust boundary, justifying S:C with full CIA impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 12, 2026 - 16:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 12, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 12, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jun 12, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Jun 12, 2026 - 16:22 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Patch available

Jun 12, 2026 - 11:01 EUVD

Analysis Generated

Jun 11, 2026 - 20:17 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical JNDI Injection RCE in Apache CXF JCA Module - CVE-2026-50633 Jun 12, 2026

AnalysisAI

Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JNDI injection when they can manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Affected versions span Apache CXF 4.2.0 to before 4.2.2, and all versions prior to 4.1.7. Despite a CVSS of 8.1, there is no public exploit identified at time of analysis and EPSS sits at 0.04%, suggesting limited near-term exploitation likelihood.

Technical ContextAI

Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and JAX-WS/JAX-RS web services on the JVM. The flaw lives in its JCA (Java EE Connector Architecture) integration, which wraps CXF services as resource adapters deployable into Java EE/Jakarta EE application servers via an ra.xml descriptor and activation specs. The root cause maps to CWE-20 (Improper Input Validation): JCA configuration values are passed into JNDI lookup operations without restricting the lookup scheme, allowing an attacker-controlled name (e.g., an LDAP or RMI URL) to trigger remote class loading and instantiation - a classic JNDI injection chain analogous to the patterns weaponized in Log4Shell.

RemediationAI

Vendor-released patch: upgrade Apache CXF to 4.2.2 (for the 4.2.x branch) or 4.1.7 (for the 4.1.x branch) as published in the Apache advisory (https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf and https://seclists.org/oss-sec/2026/q2/893). Where immediate upgrade is not possible, restrict who can modify the JCA deployment descriptor (ra.xml) and runtime activation parameters to trusted administrators only, deploy the resource adapter from controlled artifact repositories rather than user-writable filesystem paths, and consider setting JVM properties com.sun.jndi.ldap.object.trustURLCodebase=false and com.sun.jndi.rmi.object.trustURLCodebase=false to blunt remote class loading via JNDI - note these JNDI hardening flags may break legitimate uses that rely on remote-codebase resolution, so validate in pre-production first. If the JCA integration is not actually used, remove the cxf-rt-transports-jms-jca (or equivalent JCA) artifact from deployments entirely.