CVE-2026-50633

A JNDI Injection vulnerability exists in the Apache CXF JCA integration module, specifically within DispatchMDBMessageListenerImpl . An attacker who can manipulate the JCA deployment descriptor (ra.xml ) or runtime activation parameters can achieve code execution . To mitigate this risk, users ar...

org.apache.cxf.systests:cxf-systests-uncategorized (>=2.1.7, <=4.1.6), org.apache.cxf:cxf-systests (>=2.0.6, <=2.2.3) potentially affected by CVE-2026-50633 via org.apache.cxf:cxf-integration-jca (>=2.0.6, <=4.1.6)

org.apache.cxf:cxf-integration-jca MAVEN version =2.0.6, =2.1.7, =2.0.6, =2.2.3 Source cves: CVE-2026-50633 Source advisory: MEND:CVE-2026-50633...

CVE-2026-50633 Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

CVE-2026-50633

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

PT-2026-48852

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 Description A JNDI Injection issue exists in the JCA integration module. This occurs when an attacker can manipulate the JCA deployment descriptor 'ra.xml' or runtime...

PT-2026-80304

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7,...

CVE-2026-50633: Improper Input Validation

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

org.glassfish.main.admingui:console-cluster-plugin (6.2.3), org.glassfish.main.admingui:console-common-full-plugin (6.2.3) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.2.3)

org.glassfish.main.admingui:console-common MAVEN version 6.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.2.3 -...

org.glassfish.main.admingui:console-cluster-plugin (5.1.0), org.glassfish.main.admingui:console-common-full-plugin (5.1.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.1.0)

org.glassfish.main.admingui:console-common MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.1.0 -...

org.glassfish.main.admingui:console-cluster-plugin (5.1.0-rc2), org.glassfish.main.admingui:console-common-full-plugin (5.1.0-rc2) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.1.0-rc2)

org.glassfish.main.admingui:console-common MAVEN version 5.1.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.1.0-rc2 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.11), org.glassfish.main.admingui:console-common-full-plugin (7.0.11) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.11)

org.glassfish.main.admingui:console-common MAVEN version 7.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.11 -...

org.glassfish.main.admingui:console-cluster-plugin (3.1.2), org.glassfish.main.admingui:console-common-full-plugin (3.1.2) +6 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (3.1.2)

org.glassfish.main.admingui:console-common MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 3.1.2 -...

org.glassfish.main.admingui:console-cluster-plugin (6.2.0), org.glassfish.main.admingui:console-common-full-plugin (6.2.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.2.0)

org.glassfish.main.admingui:console-common MAVEN version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.2.0 -...

org.glassfish.main.admingui:console-cluster-plugin (5.0.1), org.glassfish.main.admingui:console-common-full-plugin (5.0.1) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.0.1)

org.glassfish.main.admingui:console-common MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.0.1 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.0-m1), org.glassfish.main.admingui:console-common-full-plugin (7.0.0-m1) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.0-m1)

org.glassfish.main.admingui:console-common MAVEN version 7.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.0-m1 -...

org.glassfish.main.admingui:console-cluster-plugin (6.0.0-rc2), org.glassfish.main.admingui:console-common-full-plugin (6.0.0-rc2) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.0.0-rc2)

org.glassfish.main.admingui:console-common MAVEN version 6.0.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.0.0-rc2 -...

org.glassfish.main.admingui:console-cluster-plugin (4.1.1), org.glassfish.main.admingui:console-common-full-plugin (4.1.1) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (4.1.1)

org.glassfish.main.admingui:console-common MAVEN version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 4.1.1 -...

org.glassfish.main.admingui:console-cluster-plugin (6.2.2), org.glassfish.main.admingui:console-common-full-plugin (6.2.2) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.2.2)

org.glassfish.main.admingui:console-common MAVEN version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.2.2 -...

org.glassfish.main.admingui:console-cluster-plugin (6.0.0-rc3), org.glassfish.main.admingui:console-common-full-plugin (6.0.0-rc3) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.0.0-rc3)

org.glassfish.main.admingui:console-common MAVEN version 6.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.0.0-rc3 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.0-m10), org.glassfish.main.admingui:console-common-full-plugin (7.0.0-m10) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.0-m10)

org.glassfish.main.admingui:console-common MAVEN version 7.0.0-m10 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.0-m10 -...