CVE-2026-39920 affects BridgeHead Software FileStore versions prior to 24A by exposing the Apache Axis2 administration module with default credentials on network endpoints. This insecure default configuration allows unauthenticated remote attackers to authenticate using default credentials, upload malicious Java archives as web services, and execute arbitrary OS commands through SOAP requests to the deployed service. The vulnerability is classified under CWE-1188 (Initialization of a Resource with an Insecure Default) and CWE-1391, with a critical CVSS 4.0 score of 9.3. The vendor has not provided an official remediation level or patch information, and the product is not a cloud service, so remediation depends on vendor updates or configuration changes by users.

Successful exploitation allows unauthenticated remote attackers to gain administrative access to the Apache Axis2 module, upload malicious code, and execute arbitrary commands on the host operating system. This can lead to full system compromise, data breach, and disruption of services. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should disable or restrict access to the Apache Axis2 administration module, change default credentials if possible, and limit network exposure of the affected service. Monitor vendor communications closely for updates and apply any official patches or configuration changes promptly once released.