Apache CXF JNDI Injection Vulnerability: Critical CVE Alert
- Severity
- HIGH
- Affected component
- org.apache.cxf:cxf-integration-jca (maven)
- Affected versions
- >= 4.2.0, < 4.2.2 or < 4.1.7
- Patched version
- 4.2.2, 4.1.7
An early warning has been issued for a critical JNDI Injection vulnerability in Apache CXF's JCA integration module. This vulnerability can potentially allow for code execution if an attacker manipulates the JCA deployment descriptor or runtime activation parameters.
What happened
An early warning has been issued regarding a JNDI Injection vulnerability in Apache CXF's JCA integration module. This vulnerability, tracked as GHSA-QP3F-RVJ8-46C8 and CVE-2026-50633, can potentially allow for code execution if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. The vulnerability affects versions 4.2.0 and above but below 4.2.2 or 4.1.7 of the org.apache.cxf:cxf-integration-jca Maven package.
The vulnerability was first flagged on June 12, 2026. It is currently under investigation and has not been reported as exploited in the wild. The recommended action is to upgrade to versions 4.2.2 or 4.1.7 of the affected component to mitigate the risk.
What to do about it
- Identify and inventory all instances of the org.apache.cxf:cxf-integration-jca package in your software supply chain.
- Check the versions of org.apache.cxf:cxf-integration-jca in use. If they are 4.2.0 or above but below 4.2.2 or 4.1.7, they are affected.
- Upgrade to versions 4.2.2 or 4.1.7 of org.apache.cxf:cxf-integration-jca to mitigate the vulnerability.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
How 0Day would have caught this
org.apache.cxf:cxf-integration-jca is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using versions 4.2.0 or above but below 4.2.2 or 4.1.7 of the org.apache.cxf:cxf-integration-jca Maven package.
What should I do right now?
Identify and upgrade all affected instances of org.apache.cxf:cxf-integration-jca to versions 4.2.2 or 4.1.7.
Has this vulnerability been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.