Improper XML External Entity Handling in Apache Axis2/Java
CVE-2026-120761

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Axis2/java
Vendor
CVE Published:
9 November 2026

What is CVE-2026-120761?

This vulnerability in Apache Axis2/Java allows an attacker to manipulate WSDL or imported documents to perform actions like reading local files or forcing the JVM to make unwanted network requests. This issue arises from improper handling of XML external entities and DOCTYPE declarations, potentially exposing sensitive information. Affected users should upgrade to version 2.0.2 to mitigate this vulnerability.

Affected Version(s)

Apache Axis2/Java 0 < 2.0.2

References

https://github.com/apache/axis-axis2-java-core/commit/1d3...
patch
https://axis.apache.org/axis2/java/core/release-notes/2.0...
release-notes
https://lists.apache.org/thread.html/7jw9v3qz0cdpon7fc6vs...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chinmohan Nayak
.