{"id":"CVE-2026-90436","published":"2026-11-06T16:18:59.763","lastModified":"2026-11-10T19:21:35.700","description":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-470"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","tags":[]},{"url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/12","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","tags":[]}],"hasPoc":true,"ai":{"summary":"Apache Axis 1.x deserializes untrusted SOAP fault messages by instantiating arbitrary classes via their String constructors before validating them as AxisFaults, allowing remote code execution through static initializers of loaded classes. This occurs during service resolution, bypassing per-service authentication handlers.","exploitability":"Exploitation requires sending a specially crafted SOAP fault with a <detail><exceptionName> and <data> element pointing to a class on the target's classpath; no authentication or user interaction is needed.","blast_radius":"Successful exploitation grants full remote code execution with the privileges of the Axis service, potentially compromising the entire host and any connected systems.","remediation":"Upgrade to Apache Axis2 or migrate to another SOAP engine; if Axis 1.x must be retained, apply the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd — no fixed Axis 1.x release is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","soap","auth-bypass","eol","axis"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:49:22.160Z"}}