Description
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.



As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
Published: 2026-11-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
References

Fri, 06 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
Title Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
First Time appeared Apache
Apache axis
Weaknesses CWE-470
CPEs cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*
Vendors & Products Apache
Apache axis
References

Subscriptions

Apache Axis
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-06T19:05:14.876Z

Reserved: 2026-09-11T19:51:53.432Z

Link: CVE-2026-90436

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T16:18:59.763

Modified: 2026-11-06T19:17:58.880

Link: CVE-2026-90436

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T16:45:05Z

Weaknesses