Vulnerability · medium
Apache Axis2 SSRF via WSDL/XSD schema import resolution (CVE-2026-120832)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apache Axis2/Java users below 2.0.2 building services from WSDL
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
What to do
- Upgrade Apache Axis2/Java to 2.0.2 or later.
The Brief
- Apache Axis2/Java before 2.0.2 has a Server-Side Request Forgery (SSRF) vulnerability.
- The flaw occurs when Axis2 builds a service description from a WSDL, through WSDL/XSD schema import resolution.
- The advisory is rated moderate and is tracked as CVE-2026-120832.
Why it matters
Applications that build Axis2 service descriptions from WSDL files can be tricked into making server-side requests to arbitrary locations, which can expose internal services.
The checklist behind the tier
Checklist · 1 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Axis2 is an enterprise Java web services framework that developers and ops teams run. |
| No | Core infrastructure | Judgment: a single web services framework, not core infrastructure nearly every team runs. |
| No | Popular tool | Judgment: Axis2 is a niche, legacy SOAP framework, not mainstream developer tech today. |
| No | Exploited in the wild | Open Source Security advisory: describes the SSRF flaw only; no observed attacks reported. |
| No | Public exploit | Open Source Security advisory: no exploit code or proof-of-concept mentioned in the given excerpt. |
| No | Remote, no login | Open Source Security advisory: authentication requirements not stated in the given excerpt. |
| No | Full takeover | Open Source Security advisory: SSRF described; no code execution or admin takeover reported. |
| No | Secrets exposed | Open Source Security advisory: no stolen credentials, tokens or data exposure reported. |
| No | Supply chain | Open Source Security advisory: a normal vulnerability in legitimate code, not malicious shipping. |
| No | No fix yet | Open Source Security advisory: affected versions are before 2.0.2, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-sec mailing list
Open Source Security
CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution
Source
CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution ↗ Open Source Security · 21h ago
First seen · 1 source · Full story page · How tiers are decided