CVE-2026-66713

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-66713

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66713.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-66713

Published

2026-07-28T13:44:29.702Z

Modified

2026-07-30T04:01:48.017318770Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Axis2/Java: deserialization of untrusted Data

Details

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component

in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat

(only when Tribes clustering is enabled, which is off by default) allows an

unauthenticated remote attacker with network access to the clustering port to

execute arbitrary code via a crafted serialized Java object delivered to the cluster

channel and deserialized in

org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are

recommended to upgrade to version 2.0.1, which fixes this issue by removing the

clustering feature entirely.

Database specific

{
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66713.json",
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Git / github.com/apache/axis-axis2-java-core

Affected ranges

Type

GIT

Repo

https://github.com/apache/axis-axis2-java-core

Events

Introduced

Fixed

071e45718581ed2fb282c767f800d1f50b521a66

Fixed

e6f53b230bddcb40577c84ff290ba51e7265fa15

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*

v1.8.0

v1.8.2

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66713.json"