Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Apache Axis2/Java before 2.0.2 has SSRF via WS-Addressing endpoints (CVE-2026-123753)

Original title: CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

oss-security ()
Read at seclists.org
Part of a story covered by 7 sourcesApache Axis2/Java 2.0.2 fixes seven flaws including XXE and SSRFMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

An unauthenticated caller could supply a non-anonymous WS-Addressing address

Apache Axis2/Java has a server-side request forgery vulnerability. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address.

Key facts
  • Affected versions: Apache Axis2/Java before 2.0.2
  • Severity: important
Analyze CVE-2026-123753 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-123753
Tags
apacheaxis2ssrf
Vendors
Apache
Products
Axis2/Java

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-123753
Unauthenticated SSRF in Apache Axis2/Java before 2.0.2
——

From the original article

Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2. 0. 2 Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.