Is the gateway impacted by the following CVE's ?: CVE-2026-50623, CVE-2026-50633, CVE-2026-50634

Products

• CA API Gateway

Issue/Introduction

Need additional information to prove these CVE's listed in the InfoSec scan are not present or at a minimum are not executable.  

CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService 
CVE-2026-50633: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl 
CVE-2026-50634: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry 

Environment

CA API Gateway 11.2.1-25792-2026-06-24 

Resolution

CVE-2026-50633: Not exploitable. This vulnerability affects applications deployed as a JCA resource adapter within a Java EE application server. 
                Our gateway is deployed as a standalone application rather than a Java EE app server, and the vulnerable module is not included in our environment,  so this issue does not apply.
CVE-2026-50634: Not exploitable. The issue relies on a specific module for JWS JSON signature validation and JAX-RS REST endpoints. 
                 Our deployment does not include this module and exclusively uses JAX-WS SOAP endpoints, making it completely unaffected.
CVE-2026-50623: Not exploitable. The vulnerability requires the presence of a specific OAuth2 module and an exposed OAuth2 introspection endpoint.  Our deployment does not use this module and does not configure any OAuth2 endpoints, making exploitation impossible.