CVE-2026-50632: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Synopsis

A JNDI injection vulnerability (an incomplete fix for a prior remote code execution advisory, CVE-2026-44417) affects Apache CXF versions before 4.1.7 and before 4.2.2. The flaw is reachable over the network without any authentication, though exploitation requires overcoming high attack complexity, and it allows an attacker who can influence JMS configuration to execute arbitrary code on the host. A patched-image rebuild at versions 4.1.7 and 4.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the Apache CXF service across the internet or an internal network.

• AuthenticationNot required

  No credentials or account are needed to attempt exploitation; the attacker can interact with the service as an anonymous user.

• Victim interactionNot required

  No user action or social engineering is required; the attacker can trigger the vulnerability without any participation from a legitimate user.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific environmental conditions or race conditions, such as having the ability to supply or influence untrusted JMS configuration for the CXF instance.

Blast Radius

• A successful attacker executes arbitrary code on the server hosting Apache CXF, gaining full control of that process.
• Confidential data accessible to the CXF process, including credentials, session tokens, and application records, can be read directly.
• The attacker can modify or delete persisted data and application state managed by the compromised service.
• The exploited service and any dependent services it calls can be crashed or made unavailable.