Important Apache CXF Vulnerabilities Demand Immediate Action

Security researchers disclosed multiple critical vulnerabilities in the Apache CXF services framework — including a JNDI injection enabling unauthorized code execution, a WS JSON metadata validation bypass, an inverted IP-binding OAuth2 check, and an XXE via unhardended SAXParserFactory — affecting many applications; vendors have released fixes and users are urged to upgrade to versions 4.2.2 or 4.1.7 immediately.