CVEvulnerability
CVE-2026-66713
9.8 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-07-28
- Last modified
- 2026-10-24
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
Description
Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
(only when Tribes clustering is enabled, which is off by default) allows an
unauthenticated remote attacker with network access to the clustering port to
execute arbitrary code via a crafted serialized Java object delivered to the cluster
channel and deserialized in
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are
recommended to upgrade to version 2.0.1, which fixes this issue by removing the
clustering feature entirely.
Affected configurations
• apache axis2\/java (< 2.0.1)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15 Patch
- https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728 Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/28/2 Mailing List, Third Party Advisory