critical
advisory
Apache Axis: Unauthenticated remote class instantiation (CVE-2026-90436)
Apache Axis 1.x (EOL) is vulnerable to unauthenticated remote class instantiation via deserialization of an inbound SOAP fault.
CVE search metadata
CVE search record: CVE-2026-90436. KEV: no. Product: Apache Axis 1.x (<= 1.4). Brief: Apache Axis: Unauthenticated remote class instantiation (CVE-2026-90436). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-axis-cve-2026-90436/
Triage facts
Revision 1- Applicability
- Apache Axis 1.x (<= 1.4)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 17:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
Apache Axis 1.x (EOL) contains a vulnerability where the deserialization of an inbound SOAP fault allows unauthenticated remote class instantiation.