Product
Apache Axis 1.x (EOL) is vulnerable to unauthenticated remote class instantiation via deserialization of an inbound SOAP fault.