{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90436","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","state":"PUBLISHED","assignerShortName":"apache","dateReserved":"2026-09-11T19:51:53.432Z","datePublished":"2026-11-06T15:37:55.374Z","dateUpdated":"2026-11-06T19:05:14.876Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-11-06T15:37:55.374Z"},"title":"Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName","problemTypes":[{"descriptions":[{"description":"CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')","lang":"en","cweId":"CWE-470","type":"CWE"}]}],"source":{"discovery":"EXTERNAL"},"affected":[{"vendor":"Apache Software Foundation","product":"Apache Axis 1.x (EOL)","packageURL":"pkg:maven/axis/axis","versions":[{"status":"affected","version":"0","lessThanOrEqual":"1.4","versionType":"maven"}],"defaultStatus":"affected","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"collectionURL":"https://repo.maven.apache.org/maven2","packageName":"axis:axis"},{"vendor":"Apache Software Foundation","product":"Apache Axis 1.x (EOL)","packageURL":"pkg:maven/org.apache.axis/axis","versions":[{"status":"affected","version":"0","lessThanOrEqual":"1.4","versionType":"maven"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.axis:axis"},{"vendor":"Apache Software Foundation","product":"Apache Axis 1.x (EOL)","repo":"https://gitbox.apache.org/repos/asf/axis-axis1-java.git","versions":[{"status":"affected","version":"aac718c6035435d96b39d6aebb9c078a13af7cc8","lessThan":"41f3b4e8d04e310ca81f86b92630ab2c11d608bd","versionType":"git"}],"defaultStatus":"unaffected"}],"descriptions":[{"value":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.","lang":"en","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP &lt;Fault&gt; carries a &lt;detail&gt;&lt;exceptionName&gt; element, Axis loads the named class and, if a String &lt;data&gt; element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.</p><p>As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.</p>"}]}],"references":[{"url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","tags":["patch"]},{"url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"critical"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"credits":[{"lang":"en","value":"José Apari-Pantigozo from OKIOK","type":"finder"}],"tags":["unsupported-when-assigned"],"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/12"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-11-06T19:05:14.876Z"}}]}}