Apache Axis 1.x versions through 1.4 have a vulnerability in deserializing inbound SOAP faults that allows unauthenticated remote class instantiation. When a SOAP Fault contains a detail element with an exceptionName, Axis loads and instantiates the named class before verifying it is an AxisFault. This can lead to remote code execution if a malicious class is present on the classpath. The vulnerability occurs before any service authentication handlers run, bypassing protections. Apache Axis 1.x is end-of-life and no official fix release is expected.