A JNDI Injection flaw in Apache CXF’s JCA integration allows an attacker who can alter the JCA deployment descriptor (ra.xml) or its runtime activation parameters to execute arbitrary code. The weakness is due to insufficient validation of JNDI references (CWE‑20) and is also identified as CWE‑502, potentially leading to compromise of confidentiality, integrity, and availability on affected hosts.

The flaw affects the Apache CXF product bundled by the Apache Software Foundation. Versions prior to 4.2.2 and 4.1.7 are vulnerable, as they contain the unpatched JCA integration module that processes JNDI lookups without proper validation.

The CVSS score is 8.1, and EPSS was reported to be less than 1%; the vulnerability is not listed in CISA’s KEV catalog, indicating no documented exploits yet. Still, the high CVSS score demonstrates a significant potential for code execution via a manipulated deployment descriptor. The threat remains pronounced in environments where attackers can modify configuration files or have local access. The likely attack vector involves local or privileged alteration of ra.xml or JCA activation parameters, so mitigations should focus on strict file permissions and rapid patching.