← Back to search

CVE-2026-90436

9.8 CRITICALpublic exploit available

Published 2026-11-06 · Updated 2026-11-10

AI risk analysis

Summary
Apache Axis 1.x deserializes untrusted SOAP fault messages by instantiating arbitrary classes via their String constructors before validating them as AxisFaults, allowing remote code execution through static initializers of loaded classes. This occurs during service resolution, bypassing per-service authentication handlers.
Exploitability
Exploitation requires sending a specially crafted SOAP fault with a <detail><exceptionName> and <data> element pointing to a class on the target's classpath; no authentication or user interaction is needed.
Blast radius
Successful exploitation grants full remote code execution with the privileges of the Axis service, potentially compromising the entire host and any connected systems.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Apache Axis2 or migrate to another SOAP engine; if Axis 1.x must be retained, apply the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd — no fixed Axis 1.x release is available.
rcedeserializationsoapauth-bypasseolaxis

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-470

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.