dbcve.org
CxfApplication · Apache

CVE-2026-50633

HIGH · 8.1 CVSS v3.1 Published 2026-06-12
Fix available
A fix is available. Upgrade to 4.1.7 / 4.2.2 or later.
See remediation →
90/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

JNDI Injection vulnerability in Apache CXF's JCA (Java Connector Architecture) integration module allows remote code execution. Attackers with the ability to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters can inject malicious JNDI lookups, leading to arbitrary code execution. The vulnerability affects the server-side JCA configuration of CXF-based applications.

MitigationUpgrade Apache CXF to version 4.2.2 or 4.1.7 (or later). Additionally, restrict write access to JCA deployment descriptors (ra.xml) and runtime activation parameters to prevent attacker manipulation.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
CxfApplication
Affected:< 4.1.7>= 4.2.0, < 4.2.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Determine installed Apache CXF version
    Check the CXF JAR files in your classpath or application lib directory for cxf-core, cxf jar, or similar CXF artifacts. Inspect the MANIFEST.MF file within the JAR to find the Implementation-Version attribute, or check your build configuration (pom.xml, build.gradle) for the CXF dependency version.
    Affected if The installed CXF version is less than 4.1.7, or is 4.2.0 or 4.2.1 (meaning it falls within < 4.1.7 or >= 4.2.0, < 4.2.2).
  2. Identify if JCA module is in use
    Search your deployment for the presence of JCA connector deployment descriptors. Look for files named 'ra.xml' or resource adapter configuration files within your application or application server configuration directories.
    Affected if A JCA resource adapter deployment descriptor (ra.xml) exists in your environment and is used by your application.
  3. Inspect JCA deployment descriptor for unsanitized JNDI parameters
    If an ra.xml file exists, examine its contents. Look for <config-property> elements or activation configuration where values might be derived from user input, external configuration, or untrusted sources. Pay particular attention to properties that could be used in JNDI context initialization.
    Affected if The ra.xml contains configuration properties with values that originate from user-controllable or external sources without proper sanitization.
  4. Review runtime activation parameter handling
    Examine how your application handles JCA runtime activation parameters. Check if parameters passed to the ResourceAdapter during activation could be influenced by external input, query parameters, or untrusted configuration sources. Look for code paths that pass user-supplied data into JCA initialization.
    Affected if Runtime activation parameters for JCA connectors can be manipulated by external users or are derived from untrusted input sources.

You are affected if your Apache CXF version is below 4.1.7 or between 4.2.0 and 4.2.1 inclusive, AND you use the JCA integration module with configurable deployment descriptors or activation parameters that could be influenced by untrusted input.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 4.1.7 / 4.2.2 or later
Fixed in 4.1.74.2.2
Interim mitigation

Upgrade Apache CXF to version 4.2.2 or 4.1.7 (or later). Additionally, restrict write access to JCA deployment descriptors (ra.xml) and runtime activation parameters to prevent attacker manipulation.

Recommended fix High confidence

4.2.2 (or 4.1.7 for the 4.1.x branch)

  1. Identify the current Apache CXF version in use by checking project dependencies (e.g., pom.xml for Maven, build.gradle for Gradle, or JAR manifest files)
  2. If using a version < 4.1.7 or >= 4.2.0 and < 4.2.2, plan the upgrade
  3. For Maven projects, update the CXF dependency version in pom.xml to 4.2.2 (or 4.1.7 for the 4.1.x branch)
  4. Run 'mvn clean compile' or equivalent build command to verify the upgrade succeeds
  5. Rebuild and redeploy the application
  6. Verify the application functions correctly with the new CXF version
Caveat Review release notes between your current version and 4.2.2/4.1.7 for any API or behavioral changes that may affect your application

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Cxf Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing6.0 h
  • Review / QA3.0 h
18.0 hours of engineering $3,120
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,992.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-50633 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-50633 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data