This vulnerability (CWE-502) exists in the Tribes-based clustering component of Apache Axis2/Java through version 2.0.0 on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated attacker with network access to the clustering port can send malicious serialized Java objects to the cluster channel. These objects are deserialized in the method org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived, leading to remote code execution. The vulnerability is addressed in version 2.0.1 by removing the clustering feature altogether.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on affected systems, resulting in full compromise (confidentiality, integrity, and availability impact). The vulnerability requires network access to the clustering port and that Tribes clustering is enabled, which is off by default.

Users should upgrade to Apache Axis2/Java version 2.0.1, which fixes the vulnerability by removing the Tribes clustering feature entirely. If upgrading immediately is not possible, ensure that Tribes clustering remains disabled (default setting) to avoid exposure. Patch status is not explicitly stated beyond the recommendation to upgrade to 2.0.1, so check the vendor advisory for the latest remediation guidance.