A JNDI Injection vulnerability was discovered in Apache CXF's JCA integration module, allowing code execution if an attacker can manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. The flaw is due to insufficient validation of JNDI references (CWE‑20) and is also associated with CWE‑502, potentially compromising confidentiality, integrity, and availability of affected hosts. Users are recommended to upgrade to versions 4.2.2, 4.1.7, or 3.6.12, which fixes this issue.

The flaw affects the Apache CXF product bundled by the Apache Software Foundation. Versions prior to 4.2.2 and 4.1.7 are vulnerable, as they contain the unpatched JCA integration module that processes JNDI lookups without proper validation.

The CVSS score is 8.1, and EPSS was reported to be less than 1%; the vulnerability is not listed in CISA’s KEV catalog, indicating no documented exploits yet. Still, the high CVSS score demonstrates a significant potential for code execution via a manipulated deployment descriptor. The threat remains pronounced in environments where attackers can modify configuration files or have local access. The likely attack vector involves local or privileged alteration of ra.xml or JCA activation parameters, so mitigations should focus on strict file permissions and rapid patching.