CVE-2026-39920 is a critical vulnerability affecting BridgeHead Software FileStore versions prior to 24A. The Apache Axis2 administration module is exposed on network endpoints with default credentials, enabling unauthenticated remote attackers to gain administrative access. Attackers can upload malicious Java archives as web services and execute arbitrary OS commands via SOAP requests to these services. This vulnerability is categorized under CWE-1188 (Initialization of a Resource with an Insecure Default) and CWE-1391. The CVSS 4.0 base score is 9.3, reflecting high attack vector and impact metrics. No vendor patch or official remediation level is currently documented.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the host running BridgeHead FileStore, potentially leading to full system compromise. The vulnerability arises from the use of default credentials on an exposed administration module, enabling unauthorized administrative access and malicious code execution. This poses a critical risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the Apache Axis2 administration module, change default credentials if possible, and monitor for unauthorized access attempts. Do not expose the administration interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.