CVE-2026-90436
CVSS 9.8 CRITICAL: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. EPSS 1% (67th percentile).
Vulnerabilities & Exploits
CSIRT-ITA reports active network exploitation and a public proof of concept for CVE-2026-90436, a critical remote-code-execution flaw affecting every Apache Axis 1.x version. Axis 1.x is end-of-support, and the vendor will not issue routine updates; a corrective patch is available for manual application.
The flaw is in how Axis handles incoming Simple Object Access Protocol (SOAP) error messages. Before checking whether a class is safe, Axis instantiates one named in the message. An unauthenticated attacker can send a crafted SOAP request and, if a suitable class is available, execute arbitrary code on the service host.
For organizations still running Axis 1.x, routine update status cannot establish that the vulnerable code has been corrected; the service owner inherits a manual-remediation or migration gap. CSIRT-ITA’s alert confirms exploitation but does not establish whether attackers reached connected systems.
1 source · 3h ago
CVSS 9.8 CRITICAL: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. EPSS 1% (67th percentile).
CSIRT Italia / ACN
Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436
Rilevato lo sfruttamento attivo in rete della CVE-2026-90436 - per la quale risulta disponibile anche un Proof of Concept (PoC) - presente in Apache Axis, framework open source per creare servizi web basati su SOAP (Simple Object Access Protocol).
originalPart of the PlainSec briefing for 2026-11-13
Every edition of this story: Apache Axis 1.x exploitation runs code without routine fixes