EUVD-2026-36401
GHSA-qp3f-rvj8-46c8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires attacker control of ra.xml or activation parameters (admin-level artifacts), so PR:H and AC:H; RCE in the app-server JVM crosses the resource-adapter trust boundary, justifying S:C with full CIA impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JNDI injection when they can manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Affected versions span Apache CXF 4.2.0 to before 4.2.2, and all versions prior to 4.1.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to actually use Apache CXF's JCA integration module (the resource adapter packaging) and requires the attacker to influence the JCA deployment descriptor ra.xml or runtime activation parameters supplied when the resource adapter is activated - i.e., write access to the deployed RAR/ra.xml or control over activation-spec properties passed by an administrator or orchestration layer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point sharply in different directions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who obtains write access to the application server's deployment area (via a separate vulnerability, weak admin console credentials, or a compromised CI/CD pipeline) modifies ra.xml or supplies activation parameters that point a JNDI lookup at an attacker-controlled LDAP/RMI server. When the JCA resource adapter is activated, the server resolves the malicious JNDI name, fetches a remote object reference, and instantiates attacker-supplied code in the JVM, yielding RCE as the application server process. … |
| Remediation | Vendor-released patch: upgrade Apache CXF to 4.2.2 (for the 4.2.x branch) or 4.1.7 (for the 4.1.x branch) as published in the Apache advisory (https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf and https://seclists.org/oss-sec/2026/q2/893). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Apache CXF 4.2.0-4.2.1 or 4.1.0-4.1.6, assess exposure, and create patch deployment plan. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
Remote code execution in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 can occur when untruste
HTTP Response Splitting via CRLF injection in Apache CXF's OAuth2 module allows an attacker who controls the WWW-Authent
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today