Database Management

Why SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2026-50623, CVE-2026-50633, and CVE-2026-50634

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2026-50623, CVE-2026-50633, and CVE-2026-50634.

First published date

10/12/2026 4:48 PM

Last published date

10/12/2026 6:05 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published the following security bulletins relating to Apache CXF:

Product section

Database Performance Analyzer

Cause

CVE-2026-50623 is an authentication bypass vulnerability that exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However, note that this is a safeguard only in the case that someone forgot to enable authentication on the service.

CVE-2026-50633 is a JNDI Injection vulnerability that has been discovered in the Apache CXF JCA integration module, which can allow for code execution if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters.

CVE-2026-50634 is a vulnerability in the Apache CXF JwsJsonContainerRequestFilter that can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry and may steer downstream JAX-RS entity parsing or signed-header consistency checks.

Resolution

SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2026-50623, CVE-2026-50633, or CVE-2026-50634.

CVE-2026-50623: The application does not use or include the vulnerable cxf-rt-rs-security-oauth2 module which contains the vulnerable component OAuth2 TokenIntrospectionService of this library.

CVE-2026-50633: The application does not use or include the vulnerable cxf-integration-jca module.

CVE-2026-50634: The application does not use or include the vulnerable cxf-rt-rs-security-jose-jaxrs.

While the component’s presence is flagged by dependency scanning tools, our analysis shows there is no associated security risk.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.