CVE-2026-50632

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

CVSS 8.1 HIGHEPSS 0.6%CWE-20 CWE-502

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.1EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

12 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Apache Software Foundation · Apache CXF

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://access.redhat.com/security/cve/CVE-2026-50632 https://bugzilla.redhat.com/show_bug.cgi?id=2488304 https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.json