Threats affecting pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-integration-jca

CVE-2026-50633 is a high-severity JNDI Injection vulnerability in Apache CXF's JCA integration module that allows arbitrary code execution if an attacker can manipulate the JCA deployment descriptor or runtime activation parameters. The vulnerability affects multiple versions of Apache CXF prior to 4.1.7, 4.2.2, and 3.6.12. The attack complexity is high, requiring specific conditions for exploitation. Red Hat products shipping Apache CXF are affected, but no effective mitigation is currently available that meets Red Hat's criteria. Users are recommended to upgrade to fixed versions to remediate the issue.