When running under a security manager, there is a timing issue introduced between the web container and CXF where one-way requests are dispatched using a separate thread. Configure CXF via an interceptor to always use the original thread to avoid the timing issue.