The Morning Dev

Only the news worth knowing

‹
 
C24/100

Vulnerability · critical

CVE-2026-90436: Apache Axis 1.x unauthenticated remote class instantiation

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Apache Axis 1.x through 1.4 deployments exposing SOAP endpoints

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Remote, no login · No fix yet

The Brief

  • CVE-2026-90436 affects Apache Axis 1.x (end-of-life) through version 1.4.
  • The flaw allows unauthenticated remote class instantiation via the exceptionName field of a SOAP fault.
  • Sources rate the severity as critical and reference a fixing commit (41f3b4e8d04e310ca81f86b92630ab2c11d608bd).

Why it matters

Any deployment of Apache Axis 1.x through 1.4 that processes SOAP requests may be reachable by unauthenticated remote attackers, and the project is end-of-life.

The checklist behind the tier

Checklist · 3 of 10 yes
YesHits tech teamsApache Axis is a SOAP server/library used by developers and ops teams to run web services.
NoCore infrastructureSingle framework, not shared foundational infrastructure like OpenSSH or the Linux kernel.
NoPopular toolAxis 1.x is end-of-life and niche, mainly found in legacy enterprise SOAP systems.
NoExploited in the wildOpen Source Security advisory only describes the flaw; no observed attacks are reported.
NoPublic exploitOpen Source Security advisory gives no exploit code or proof-of-concept; it only describes the issue.
YesRemote, no loginOpen Source Security: CVE-2026-90436 is an unauthenticated remote class instantiation flaw.
NoFull takeoverOpen Source Security does not state code execution or admin takeover; only class instantiation is described.
NoSecrets exposedOpen Source Security reports no stolen credentials, configs, source code or customer data.
NoSupply chainOpen Source Security describes a SOAP fault parsing flaw, not compromised packages or build pipelines.
YesNo fix yetOpen Source Security: Apache Axis 1.x is end-of-life, so no supported patched release is expected.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-90436 ↗

    Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

    Exploited
    Not in CISA’s exploited catalog
    Weakness
    CWE-470

    NVD

Timeline

  1. Vulnerability posted to the oss-sec mailing list

  2. Open Source Security

    CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

Source

CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName ↗ Open Source Security · 2h ago

First seen · 1 source · Full story page · How tiers are decided