The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 24 · Tier C

CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

oss-security ·

The Brief

  • CVE-2026-90436 affects Apache Axis 1.x (end-of-life) through version 1.4.
  • The flaw allows unauthenticated remote class instantiation via the exceptionName field of a SOAP fault.
  • Sources rate the severity as critical and reference a fixing commit (41f3b4e8d04e310ca81f86b92630ab2c11d608bd).

Why it matters

Any deployment of Apache Axis 1.x through 1.4 that processes SOAP requests may be reachable by unauthenticated remote attackers, and the project is end-of-life.

Who’s affected

  • Teams running Apache Axis 1.x through 1.4

Posted by Robert Lazarski on Nov 06 Severity: critical Affected versions: - Apache Axis 1.x (EOL) through 1.4 - Apache Axis 1.x (EOL) through 1.4 - Apache Axis 1.x (EOL) aac718c6035435d96b39d6aebb9c078a13af7cc8 before 41f3b4e8d04e310ca81f86b92630ab2c11d608bd Description: **…

Read the full story at seclists.org ↗

Timeline

  1. Vulnerability posted to the oss-sec mailing list

  2. Open Source Security

    CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

How do you feel about this?

0 Comments