{"id":"CVE-2026-90436","aliases":[],"cve":{"records":[{"id":"CVE-2026-90436","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":true,"reserved":"2026-09-11T19:51:53.432Z","published":"2026-11-06T15:37:55.374Z","modified":"2026-11-06T19:05:14.876Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-06T15:37:55.374Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-11-06T19:05:14.876Z"}],"references":[{"url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/12","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-470","description":"CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName","titleSource":"apache","descriptionSource":"apache","description":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.","score":null,"severity":"unknown","published":"2026-11-06T15:37:55.374Z","modified":"2026-11-06T19:05:14.876Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Axis 1.x (EOL)","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.4","versionType":"maven"}],"defaultStatus":"affected","packageURL":"pkg:maven/axis/axis","packageIdentity":{"ecosystem":"Maven","name":"axis:axis"},"cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436"},{"vendor":"Apache Software Foundation","name":"Apache Axis 1.x (EOL)","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.4","versionType":"maven"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.axis/axis","packageIdentity":{"ecosystem":"Maven","name":"org.apache.axis:axis"},"cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436"},{"vendor":"Apache Software Foundation","name":"Apache Axis 1.x (EOL)","platforms":[],"versions":[{"version":"aac718c6035435d96b39d6aebb9c078a13af7cc8","status":"affected","lessThan":"41f3b4e8d04e310ca81f86b92630ab2c11d608bd","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436"}],"remediation":[],"references":["https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","http://www.openwall.com/lists/oss-security/2026/11/06/12"],"sources":[{"name":"CVE","id":"CVE-2026-90436","modified":"2026-11-06T19:05:14.876Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-06T19:22:10.763Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:20:33.336Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-06T15:55:34.760Z","attemptedAt":"2026-11-06T15:55:34.760Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T15:55:34.760Z","attemptedAt":"2026-11-06T15:55:34.760Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-06T15:55:35.208Z","attemptedAt":"2026-11-06T15:55:35.208Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T15:55:34.760Z","attemptedAt":"2026-11-06T15:55:34.760Z"}],"evidence":[],"aiSummary":{"text":"Apache Axis 1.x through 1.4 allows unauthenticated remote class instantiation via a SOAP fault exceptionName. An attacker can exploit this by sending a crafted SOAP fault. The impact is related to deserialization of inbound SOAP faults.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T15:56:04.598Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436"}]}}