CVE-2026-50633Disclosure(apache / cxf)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache cxf systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-20CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 2 mentions (2026-06-12); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

apache

Products

cxf

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	2	Disclosure2
2026-06-13	1	Patch1
2026-06-15	1	Patch1

Full discourse4 posts

MY TECH BLOG@MyTechBlogJP132d
Patch
Apache CXF に JNDI 注入の脆弱性 CVE-2026-50633（コード実行の恐れ）・対象は cxf-integration-jca の JCA RAR 構成・根本対処は 4.2.2 / 4.1.7 へ・暫定策は未使用モジュール除去と通信遮断 https://mytech-blog.com/apache-cxf-jndi-injection/ #ApacheCXF #セキュリティ
Post summary
The text announces CVE-2026-50633, a JNDI injection flaw in Apache CXF, and outlines the required patch versions along with interim mitigations.
0001081
175 followersView on X
DFIR Lab@DFIR_Lab135d
Patch
🚨 HIGH SEVERITY: CVE-2026-50633 (CVSS 8.1) JNDI Injection in Apache CXF JCA module enables code execution if attacker manipulates ra[.]xml or runtime parameters. Patch NOW: Upgrade to 4.2.2 or 4.1.7 #CVE #PatchNow #ThreatIntel https://t.co/ytHu4Ydcjp
Post summary
The tweet highlights the high‑severity CVE-2026-50633 involving JNDI injection in Apache CXF JCA, details the exploitation vector, and urges users to upgrade to specific patched versions.
0000029
44 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-50633 A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate th… https://www.cve.org/CVERecord?id=CVE-2026-50633
Post summary
The text announces the discovery of a JNDI injection vulnerability in Apache CXF’s JCA integration module that could lead to code execution if an attacker exploits it; no PoC, exploit, or patch details are provided.
00000155
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-50633 JNDI Injection Vulnerability in Apache CXF JCA Integration Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50633 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE-2026-50633, a JNDI injection flaw in the Apache CXF JCA Integration Module, and provides links to vulnerability details and customizable alerts.
0000053
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	cxf	-	-	-

Explore more

Back to dashboard apache CVEs cxf vulnerabilities

What researchers are saying

CVE-2026-50633

DFIR Lab[verified]@DFIR_LabPatch

The tweet highlights the high‑severity CVE-2026-50633 involving JNDI injection in Apache CXF JCA, details the exploitation vector, and urges users to upgrade to specific patched versions.

MY TECH BLOG@MyTechBlogJPPatch

The text announces CVE-2026-50633, a JNDI injection flaw in Apache CXF, and outlines the required patch versions along with interim mitigations.

CVE@CVEnewDisclosure

The text announces the discovery of a JNDI injection vulnerability in Apache CXF’s JCA integration module that could lead to code execution if an attacker exploits it; no PoC, exploit, or patch details are provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2026-50633, a JNDI injection flaw in the Apache CXF JCA Integration Module, and provides links to vulnerability details and customizable alerts.