EUVD-2026-36401
GHSA-qp3f-rvj8-46c8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify CXF JCA deployment
-
DeliveryGain write access to ra.xml or activation params
-
ExploitInject malicious JNDI URL (LDAP/RMI)
-
InstallTrigger resource adapter activation
-
C2JVM fetches remote object reference
-
ExecuteAttacker class instantiated in server JVM
-
ImpactCode execution as app server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the target to actually use Apache CXF's JCA integration module (the resource adapter packaging) and requires the attacker to influence the JCA deployment descriptor ra.xml or runtime activation parameters supplied when the resource adapter is activated - i.e., write access to the deployed RAR/ra.xml or control over activation-spec properties passed by an administrator or orchestration layer. Limiting factors: CVSS AC:H reflects that the JCA module is not enabled by default in many CXF deployments, ra.xml is normally an admin-controlled artifact, and the JVM must permit remote-codebase JNDI resolution (trustURLCodebase=true on modern JDKs is non-default) for the classic remote-class-loading chain to land. |
| Impact | Signals point sharply in different directions. CVSS 3.1 rates this 8.1 High (AV:N/AC:H/PR:N/UI:N) with full CIA impact, but the AC:H and the description's prerequisite of modifying ra.xml or runtime activation parameters tell a more nuanced story - in practice an attacker typically needs influence over deployment artifacts or activation configuration that should not be attacker-controlled in a hardened environment. CISA SSVC reports Exploitation: none, Automatable: yes, Technical Impact: total, which combined with EPSS 0.04% (12th percentile) and no CISA KEV listing indicates a serious-impact but currently low-probability issue. There is also a tension between the CVSS PR:N rating and the description's reliance on attacker control of JCA configuration, which would normally justify PR:L or PR:H - defenders should verify the precise threat model against their deployment rather than treating this as a generic unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker who obtains write access to the application server's deployment area (via a separate vulnerability, weak admin console credentials, or a compromised CI/CD pipeline) modifies ra.xml or supplies activation parameters that point a JNDI lookup at an attacker-controlled LDAP/RMI server. When the JCA resource adapter is activated, the server resolves the malicious JNDI name, fetches a remote object reference, and instantiates attacker-supplied code in the JVM, yielding RCE as the application server process. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 12, 2026
Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JNDI injection when they can manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Affected versions span Apache CXF 4.2.0 to before 4.2.2, and all versions prior to 4.1.7. Despite a CVSS of 8.1, there is no public exploit identified at time of analysis and EPSS sits at 0.04%, suggesting limited near-term exploitation likelihood.
Earlier versions of this analysis (2)
Remote code execution in Apache CXF's JCA integration module (versions before 4.2.2 and 4.1.7) is possible via a JNDI injection flaw that triggers when an attacker can manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%), but CISA SSVC rates the technical impact as total and considers exploitation automatable once preconditions are met.
JNDI Injection in Apache CXF's JCA integration module (cxf-integration-jca) enables remote code execution when an attacker can influence the JCA deployment descriptor (ra.xml) or runtime activation parameters processed by DispatchMDBMessageListenerImpl. Affected versions are 4.2.0 through 4.2.1 and all versions prior to 4.1.7 of the cxf-integration-jca artifact. Vendor-released patches 4.2.2 and 4.1.7 were published June 10, 2026; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Apache CXF to 4.2.2 (for the 4.2.x branch) or 4.1.7 (for the 4.1.x branch) as published in the Apache advisory (https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf and https://seclists.org/oss-sec/2026/q2/893). Where immediate upgrade is not possible, restrict who can modify the JCA deployment descriptor (ra.xml) and runtime activation parameters to trusted administrators only, deploy the resource adapter from controlled artifact repositories rather than user-writable filesystem paths, and consider setting JVM properties com.sun.jndi.ldap.object.trustURLCodebase=false and com.sun.jndi.rmi.object.trustURLCodebase=false to blunt remote class loading via JNDI - note these JNDI hardening flags may break legitimate uses that rely on remote-codebase resolution, so validate in pre-production first. If the JCA integration is not actually used, remove the cxf-rt-transports-jms-jca (or equivalent JCA) artifact from deployments entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and JAX-WS/JAX-RS web services on the JVM. The flaw lives in its JCA (Java EE Connector Architecture) integration, which wraps CXF services as resource adapters deployable into Java EE/Jakarta EE application servers via an ra.xml descriptor and activation specs. The root cause maps to CWE-20 (Improper Input Validation): JCA configuration values are passed into JNDI lookup operations without restricting the lookup scheme, allowing an attacker-controlled name (e.g., an LDAP or RMI URL) to trigger remote class loading and instantiation - a classic JNDI injection chain analogous to the patterns weaponized in Log4Shell.
Know when Cxf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires attacker control of ra.xml or activation parameters (admin-level artifacts), so PR:H and AC:H; RCE in the app-server JVM crosses the resource-adapter trust boundary, justifying S:C with full CIA impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Apache CXF's JCA integration module (versions 4.2.0-4.2.1 and 4.1.0-4.1.6) contains a high-severity remote code execution vulnerability allowing attackers to execute arbitrary code through deployment descriptor manipulation. Organizations using Apache CXF for enterprise integration are directly exposed to unauthorized code execution and system compromise. While no active exploitation has been confirmed, the broad version impact and integration criticality require immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Exploit-DB