CVE-2026-90436 · Package
NO FIX YET · SEE WHAT TO DO
Apache Axis 1.x parses SOAP fault messages and loads a class named in the fault, then instantiates it through a String constructor, before any service authentication runs. With a suitable class on the classpath, an unauthenticated remote attacker can achieve remote code execution.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any application that runs Apache Axis 1.x (through 1.4) as a SOAP server exposes the fault-parsing path to network clients, and the fault is parsed before per-service authentication handlers run, so those handlers do not protect it. Exploitation needs a suitable class on the application's classpath. Systems that do not run Axis 1.x, or that run it without a SOAP endpoint reachable by others, are less exposed.
Not affected if axis-2-in-use, no-axis-1-jar
Who cares apache-axis, java, self-hosted, soap
find / -name axis*.jar 2>/dev/null1.4 are affected1.4: no release fixes this; the Apache project recommends migrating to Apache Axis 2/Java** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.
As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.