CVE-2026-50633

Katalog CVE

CVSS 8.1 · High EPSS 1,3%

Kerentanan Improper Input Validation pada apache cxf. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf advisory vendor
• http://www.openwall.com/lists/oss-security/2026/06/11/10 mailing list · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:37390
• https://access.redhat.com/security/cve/CVE-2026-50633
• https://bugzilla.redhat.com/show_bug.cgi?id=2488307
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50633.json