External risk intelligence

Apache Axis2 Java XML External Entity Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-120761

The vulnerability exists in a client-side library function used to process WSDL URLs. While it can be triggered if an application is configured to accept and process untrusted or attacker-controlled WSDL inputs, it is not a default internet-facing service or listener. Exposure depends heavily on the specific implementation and whether the application exposes WSDL processing functionality to user-supplied input.

XML External Entity Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Apache Axis2/Java that could allow an attacker to read local files or initiate network requests by controlling specific input. This issue impacts how the system processes certain imported documents, presenting a potential risk if external or untrusted data is used. The main concern at this time is confirming relevance and exposure within our environments.

XML processing flaw allows unauthorized data access.
Affects systems that process external WSDL documents.
Confirm relevance and exposure to specific applications.

Attack Path

How an attacker could exploit the issue

An attacker who controls a Web Services Description Language (WSDL) document, or a document it imports, can exploit this vulnerability. By tricking a vulnerable Axis2/Java application into processing a malicious WSDL, the attacker can cause the application to read local files or make the Java Virtual Machine issue network requests.

Requires processing of attacker-controlled WSDL.
Vulnerability triggered by parsing WSDL imports.
Risk of local file reading and network requests.

Live Threat

Current exploitation, exposure, and threat context

When an attacker controls a WSDL file or an imported document, they could cause the affected system to read local files or issue unintended network requests to external resources. This may occur when the system processes WSDL URLs for client-side service creation.

Local files or network access may be exposed.
Via processing of attacker-controlled WSDLs.
Compromise of system integrity and confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in Apache Axis2/Java, as it affects how WSDLs are processed on the client side. The first practical step is to identify all instances of the affected technology, determine their reachability and business criticality, and then locate the accountable owners to prioritize remediation efforts based on assessed risk.

Own the issue: Application and platform teams.
Verify first: Identify affected WSDL processing instances.
Action follows: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Axis2/Java?

Apache Axis2/Java is a foundational framework used by developers to build and deploy Web Services. It allows applications to communicate by exchanging structured data, often using the WSDL format to define how services operate. Many enterprise applications rely on it to handle service-oriented communications and process complex XML-based requests.

How does CVE-2026-120761 affect XML processing?

This vulnerability is classified as an XML External Entity (XXE) flaw. It happens when the software's XML parser is configured to resolve external references within a document. Because the parser is overly trusting, an attacker can include malicious instructions in an XML file to force the application to read files from the host system's local storage or make unauthorized network connections.

When does this vulnerability trigger?

The issue triggers specifically when an application uses Axis2/Java to build a service client from an untrusted WSDL URL. Simply having the library installed is not enough; the vulnerability requires the system to actively parse a WSDL document—or its imported components—that has been crafted by an attacker to include malicious entity declarations.

Do I need to worry if my service isn't public?

Halo Surface Signal indicates that while this is not a default internet-facing listener, risk depends on your implementation. You should consider whether your application accepts and processes WSDL inputs from external sources or untrusted users. If your internal tools parse WSDLs provided by third parties or unverified endpoints, they may still be vulnerable.

How do I start addressing this vulnerability?

First, locate all applications within your environment that utilize Apache Axis2/Java, specifically focusing on components that process WSDL URLs. Once identified, work with the relevant application teams to assess if those WSDL inputs can be influenced by outside actors. The official path to resolution is upgrading your Axis2/Java implementation to version 2.0.2.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.