{"api_version":"1","generated_at":"2026-11-06T16:42:42+00:00","cve":"CVE-2026-90436","urls":{"html":"https://cve.report/CVE-2026-90436","api":"https://cve.report/api/cve/CVE-2026-90436.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90436","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90436"},"summary":{"title":"Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName","description":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-06 16:18:59","updated_at":"2026-11-06 16:18:59"},"problem_types":["CWE-470","CWE-470 CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')"],"metrics":[],"references":[{"url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","name":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","name":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90436","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90436","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Axis 1.x (EOL)","version":"affected 1.4 maven","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Axis 1.x (EOL)","version":"affected 1.4 maven","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Axis 1.x (EOL)","version":"affected aac718c6035435d96b39d6aebb9c078a13af7cc8 41f3b4e8d04e310ca81f86b92630ab2c11d608bd git","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"José Apari-Pantigozo from OKIOK","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"defaultStatus":"affected","packageName":"axis:axis","packageURL":"pkg:maven/axis/axis","product":"Apache Axis 1.x (EOL)","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"org.apache.axis:axis","packageURL":"pkg:maven/org.apache.axis/axis","product":"Apache Axis 1.x (EOL)","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Apache Axis 1.x (EOL)","repo":"https://gitbox.apache.org/repos/asf/axis-axis1-java.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"41f3b4e8d04e310ca81f86b92630ab2c11d608bd","status":"affected","version":"aac718c6035435d96b39d6aebb9c078a13af7cc8","versionType":"git"}]}],"credits":[{"lang":"en","type":"finder","value":"José Apari-Pantigozo from OKIOK"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP &lt;Fault&gt; carries a &lt;detail&gt;&lt;exceptionName&gt; element, Axis loads the named class and, if a String &lt;data&gt; element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.</p><p>As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.</p>"}],"value":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem."}],"metrics":[{"other":{"content":{"text":"critical"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-470","description":"CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-06T15:37:55.374Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["patch"],"url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd"},{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz"}],"source":{"discovery":"EXTERNAL"},"tags":["unsupported-when-assigned"],"title":"Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-90436","datePublished":"2026-11-06T15:37:55.374Z","dateReserved":"2026-09-11T19:51:53.432Z","dateUpdated":"2026-11-06T15:37:55.374Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-06 16:18:59","lastModifiedDate":"2026-11-06 16:18:59","problem_types":["CWE-470","CWE-470 CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90436","Ordinal":"1","Title":"Apache Axis 1.x (EOL): unauthenticated remote class instantiatio","CVE":"CVE-2026-90436","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90436","Ordinal":"1","NoteData":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.","Type":"Description","Title":"Apache Axis 1.x (EOL): unauthenticated remote class instantiatio"}]}}}