CVE-2026-50632

HighCVSS 8.1/10Last modified Nov 5, 2026

Description

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12
Red Hat	Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16	—
Red Hat	Red Hat Fuse 7	—
Red Hat	Red Hat JBoss Enterprise Application Platform 7	—
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—
Red Hat	Red Hat Single Sign-On 7	—

References

https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcwVendor Advisory
https://access.redhat.com/errata/RHSA-2026:37390Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-50632Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2488304Issue Tracking, Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50632.jsonThird Party Advisory

Timeline

Published: Jun 12, 2026
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-506338.1A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacke CVE-2026-506346.5A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated b CVE-2026-506358.8LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHost CVE-2026-506368.8The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninv CVE-2026-506378.2Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions CVE-2026-506389.1Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensi CVE-2026-506396.5Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensio CVE-2026-50648.5Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow fo CVE-2026-506417.1Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, us CVE-2026-506424.8diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SG CVE-2026-506435.18cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-c CVE-2026-506448.6SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL com