CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
- Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 1 public report, the first from .
- How likely is exploitation in the next 30 days?
- 1.1%
EPSS score, percentile 66.8 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.8 Critical
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- 1.4 and earlier
- 1.4 and earlier
Source: CISA KEV 2026.11.10, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (3 products)
| Status | Versions |
|---|---|
| Affected | 1.4 and earlier |
Versions not listed are: affected.
| Status | Versions |
|---|---|
| Affected | 1.4 and earlier |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | from aac718c60354 to before 41f3b4e8d04e |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
Weakness
CWE-470
- CWE-470: Use of Externally-Controlled input to select classes or code ('unsafe reflection')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
Known exploited Apache vulnerabilities
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability