External risk intelligence

Apache Axis 1.x Remote Code Execution via SOAP Fault Deserialization

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-90436

Apache Axis is a SOAP engine typically deployed as an application server component or web service middleware. It is designed to process external web service requests and often resides on public-facing application servers or API gateways to facilitate service-oriented communication, making it a common internet-reachable service in many enterprise environments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical deserialization vulnerability in Apache Axis 1.x. The issue allows unauthenticated remote code execution by manipulating SOAP faults, bypassing standard security checks. Given that Apache Axis 1.x is End-of-Life, the primary concern is confirming its presence and exposure within your environment, as it is no longer supported by the vendor and therefore unpatchable.

Unauthenticated remote code execution via SOAP faults.
Affects unsupported Apache Axis 1.x technology.
Confirm relevance and exposure of unsupported software.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending a specially crafted SOAP fault message to an exposed Apache Axis service. This message can cause the server to deserialize untrusted data, leading to the execution of arbitrary code. The vulnerability lies in how the Axis engine processes inbound SOAP faults, specifically the handling of the `<detail><exceptionName>` and `<data>` elements within the fault structure. Since this processing occurs before authentication checks, an unauthenticated remote attacker can exploit it.

No authentication required to trigger.
Triggered by malicious SOAP fault message.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows unauthenticated remote code execution on systems running Apache Axis 1.x. When an inbound SOAP fault contains a specific element, Axis can be tricked into loading and instantiating a malicious class from the application's classpath, bypassing typical authentication checks. This occurs early in the request processing, before service-specific security measures are applied, when supported by the advisory.

Application servers running Apache Axis 1.x.
Remote class instantiation via crafted SOAP faults.
Complete system compromise and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Apache Axis 1.x deserialization vulnerability likely impacts application owners and platform teams responsible for web services and middleware. The first practical step is to identify all instances of Apache Axis 1.x, determine their exposure and criticality, and then plan remediation. Given that Axis 1.x is End-of-Life and the vendor does not plan to release a patch, migration to a supported SOAP engine like Apache Axis 2 is the recommended long-term solution, with a potential temporary mitigation by applying a specific build containing a patch.

Identify Axis 1.x instances and exposure.
Confirm business criticality and accountable owner.
Plan migration or apply workaround.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Axis 1.x?

Apache Axis is a Java-based framework used to build and deploy SOAP-based web services. It acts as middleware or an engine within an application server, enabling systems to communicate by exchanging structured XML messages over protocols like HTTP. Because it is an older technology, it is often found in legacy enterprise applications that require SOAP connectivity for service-oriented architecture.

How does CVE-2026-90436 allow remote code execution?

This vulnerability is an instance of CWE-470: Use of Externally-Controlled Input to Select Classes or Code. The Apache Axis engine improperly handles deserialization when processing a specially crafted SOAP fault. By sending a message with specific elements, an attacker can force the server to load and instantiate arbitrary classes present on the system's classpath, which can result in the execution of unintended code.

Can I trigger this by just accessing a secure web service?

No, standard service authentication will not stop this. The vulnerability occurs very early in the request processing pipeline, specifically when the engine is resolving the target service. Because this parsing happens before any configured security or authentication handlers are invoked, an attacker can trigger the flaw regardless of whether the target web service itself requires a valid login.

Why should I worry about CVE-2026-90436 in my network?

According to Halo Surface Signal, Apache Axis is typically used as middleware on web servers or API gateways, making it a highly likely candidate for internet-facing exposure. Since this component is designed to process external service requests, it provides a direct path for remote attackers to interact with the underlying application server, potentially leading to a full compromise.

What is the recommended first step for this vulnerability?

The priority is to locate all deployments of Apache Axis 1.x within your environment, as it is no longer supported by the vendor. Once identified, you should transition to a modern, supported alternative like Apache Axis 2. Because no official patches will be released for the 1.x branch, upgrading your infrastructure is the only way to effectively eliminate the underlying risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.