The vulnerability (CVE-2026-66713) involves unsafe deserialization in the Tribes-based clustering component of Apache Axis2/Java up to version 2.0.0. When Tribes clustering is enabled, an unauthenticated attacker can remotely send malicious serialized Java objects to the cluster channel. These objects are deserialized in the method org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived, leading to arbitrary code execution. The default configuration disables Tribes clustering, reducing exposure. The vendor fixed the issue in version 2.0.1 by removing the clustering feature altogether.

Successful exploitation allows unauthenticated remote attackers with network access to the clustering port to execute arbitrary code on the affected system. This can lead to full compromise of the Axis2/Java service and potentially the underlying host. The impact includes complete confidentiality, integrity, and availability loss of the affected system. However, the vulnerability only applies if Tribes clustering is enabled, which is off by default.

Users should upgrade to Apache Axis2/Java version 2.0.1 or later, where the vulnerable Tribes clustering feature has been removed. If upgrading immediately is not possible, ensure that Tribes clustering remains disabled (the default setting) to avoid exposure. No other mitigations are specified by the vendor.