Apache Axis 1.x unauthenticated remote class instantiation via SOAP (CVE-2026-90436)
Original title: CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
Deserialization of inbound SOAP faults in Apache Axis 1.x allows unauthenticated remote class instantiation; unsupported as end-of-life.
Apache Axis 1.x through 1.4 deserializes inbound SOAP faults allowing unauthenticated remote class instantiation. The issue remains unsupported as Apache Axis 1.x is end-of-life. No patches or mitigations are provided.
Unconfirmed: No public exploitation reported
- Affected: Apache Axis 1.x through 1.4
- Unauthenticated
- Remote class instantiation
- Unsupported since EOL
Impact: unauthenticated remote class instantiation
| Product | Affected |
|---|---|
| Apache Axis | 1.x through 1.4 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90436 | Unauthenticated RCE in Apache Axis 1.x via SOAP fault | 9.8 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 41f3b4e8d04e310ca81f86b92630ab2c11d608bd | s 1.x (EOL) aac718c6035435d96b39d6aebb9c078a13af7cc8 before 41f3b4e8d04e310ca81f86b92630ab2c11d608bd Description: ** UNSUPPORTED WHEN ASSIGNED ** Deserializatio |
| sha1 | aac718c6035435d96b39d6aebb9c078a13af7cc8 | - Apache Axis 1.x (EOL) through 1.4 - Apache Axis 1.x (EOL) aac718c6035435d96b39d6aebb9c078a13af7cc8 before 41f3b4e8d04e310ca81f86b92630ab2c11d608bd Description |
From the original article
Posted by Robert Lazarski on Nov 06 Severity: critical Affected versions: - Apache Axis 1. x (EOL) through 1. 4 - Apache Axis 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.