Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-50632US | — | — | ||
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution cap… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:37390WEB
- https://access.redhat.com/security/cve/CVE-2026-50632WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2488304WEB
- https://github.com/apache/cxfPACKAGE
- https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcwWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-50632ADVISORY
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.jsonWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan