CVE-2026-50632

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

CVSS 8.1 HIGHEPSS 0.6%CWE-20 CWE-502

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.1EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

12 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Apache Software Foundation · Apache CXF

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://access.redhat.com/security/cve/CVE-2026-50632 https://bugzilla.redhat.com/show_bug.cgi?id=2488304 https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.json