Apache Axis2/Java before 2.0.2 vulnerable to XML External Entity injection (CVE-2026-120761)
Original title: CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
The XML External Entity (XXE) injection vulnerability in Apache Axis2/Java allows attackers to inject external entities when clients import WSDL/XSD documents via wsdl4j.
Apache Axis2/Java has an improper restriction of XML External Entity Reference vulnerability. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser. This affects versions before 2.0.2.
- Improper restriction of XML External Entity Reference
- Affected: Apache Axis2/Java before 2.0.2
- Fixed in: 2.0.2
- Impacts WSDL/XSD document imports
Impact: XML External Entity injection
- 1.Upgrade to version 2.0.2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120761 | XXE injection in Apache Axis2/Java via WSDL | — | — |
From the original article
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2. 0. 2 Description: Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.