CVE-2026-90436: Apache Axis 1.x (EOL) · Reflection Injection
Affects Apache Axis 1.x (EOL)Source CVE Database V5
Not known to be exploited : upgrade to 41f3b4e8d04e310ca81f86b92630ab2c11d608bd when convenient.
Data as of 6 Nov 2026, 15:49 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 41f3b4e8d04e310ca81f86b92630ab2c11d608bd
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade Apache Axis 1.x (EOL) to 41f3b4e8d04e310ca81f86b92630ab2c11d608bd.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis 1.x (EOL)axis:axis | Affected
| Fixed in– |
| Apache Axis 1.x (EOL)org.apache.axis:axis | Affected
| Fixed in– |
| Apache Software FoundationApache Axis 1.x (EOL) | Affected
| Fixed in
|
Mavenaxis/axispkg:maven/axis/axisOther threats | Affected
| Fixed in– |
Mavenorg.apache.axis/axispkg:maven/org.apache.axis/axisOther threats | Affected
| Fixed in– |
CPE configurations (1)
cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.