CVE-2026-50632

HighCVSS 8.1/10Last modified Aug 7, 2026

Description

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Aug 7, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-506338.1A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attackeCVE-2026-506346.5A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated bCVE-2026-506358.8LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHostCVE-2026-506368.8The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvCVE-2026-506378.2Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensionsCVE-2026-506389.1Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensiCVE-2026-506396.5Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensioCVE-2026-50648.5Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow foCVE-2026-506417.1Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, usCVE-2026-506424.8diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGCVE-2026-506435.18cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-cCVE-2026-506448.6SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL com
CVE-2026-50632: High severity, CVSS 8.1 | Vulnix