{"id":"CVE-2026-50632","published":"2026-06-12T09:00:48Z","modified":"2026-08-07T12:43:28Z","title":"Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory","vendor":"Apache","product":"Apache CXF","tier":"tail","description":{"text":"A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00669,"percentile":0.5181,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50632","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488304","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":16.0,"factors":[{"name":"EPSS percentile","points":10.36},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache CXF","versions":[">= 4.2.0, < 4.2.2",">= 4.0.0, < 4.1.7","< 3.6.12"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-transports-jms","vulnerableRanges":[">=4.2.0, <4.2.2",">=4.1.0, <4.1.7","<3.6.12"],"patched":["4.2.2","4.1.7","3.6.12"],"from":["GHSA-93g8-qqv3-mrx8"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-36400","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-cxf-cve-2025-48913","parents":[{"from":"CVE-2026-44417","to":"CVE-2026-50632","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS…","from":"CVE.org","in":"CVE-2026-50632"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.cxf:cxf-rt-transports-jms","fromFixed":"4.2.1","toFixed":"4.2.2","daysApart":21},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.cxf:cxf-rt-transports-jms","fromFixed":"3.6.11","toFixed":"3.6.12","daysApart":21},{"kind":"similar","provenance":"machine","score":0.76,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2025-48913","published":"2025-08-08","fixed":"4.1.3","kev":false},{"cve":"CVE-2026-44417","published":"2026-05-22","fixed":"4.2.1","kev":false},{"cve":"CVE-2026-50632","published":"2026-06-12","fixed":"4.2.2","kev":false}],"package":"Maven:org.apache.cxf:cxf-rt-transports-jms"}}