Apache Axis 1.x unauthenticated remote class instantiation via SOAP (CVE-2026-90436)
Deserialization of inbound SOAP faults in Apache Axis 1.x allows unauthenticated remote class instantiation; unsupported as end-of-life.
75
CVE-2026-90436
Unauthenticated RCE in Apache Axis 1.x via SOAP fault
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Deserialization of inbound SOAP faults in Apache Axis 1.x enables unauthenticated remote class instantiation and RCE. An attacker crafts a SOAP message that triggers static initializers on the classpath before authentication. All versions through 1.4 are affected.
What to do: Migrate to Apache Axis 2 or apply the patch from the provided commit. Upgrade to a different SOAP engine.
| Product | Affected |
|---|---|
| Apache Axis | 1.x through 1.4 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a element, Axis loads the named class and, if a String element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
- Weakness
- CWE-470
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H