Deserialization Vulnerability in Apache Axis 1.x Allows Remote Code Execution

CVE-2026-90436

What is CVE-2026-90436?

A vulnerability exists in Apache Axis 1.x that allows unauthenticated remote class instantiation through the deserialization of an inbound SOAP fault. This occurs when a SOAP includes a element, leading Axis to load and instantiate a class specified in the exceptionName. If a String element is also included, the class is instantiated using its String constructor without appropriate validation, potentially allowing for the execution of arbitrary code on the server. This vulnerability affects all versions of Apache Axis 1.x up to and including 1.4, as the issue is executed before any service-specific authentication handlers are triggered. Organizations using affected versions are advised to migrate to Apache Axis 2/Java or apply the appropriate patch found on their GitHub repository.

References