9.8

CVE-2026-66713

Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component

  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat

  (only when Tribes clustering is enabled, which is off by default) allows an

  unauthenticated remote attacker with network access to the clustering port to

  execute arbitrary code via a crafted serialized Java object delivered to the cluster

  channel and deserialized in

  org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are

  recommended to upgrade to version 2.0.1, which fixes this issue by removing the

  clustering feature entirely.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Axis2/java Version < 2.0.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.83% 0.768
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15
Patch
https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2026/07/28/2
Third Party Advisory
Mailing List