CVE-2026-50632

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

CVSS 8.1 HIGHEPSS 0.6%CWE-20 CWE-502

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

12 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Software Foundation · Apache CXF

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://access.redhat.com/security/cve/CVE-2026-50632 https://bugzilla.redhat.com/show_bug.cgi?id=2488304 https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.json