Apache Axis2 Default Login

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...

Security Bulletin: Deserialization of Untrusted Data in Apache Axis2 affects AS4 of IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-66713)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-66713 DESCRIPTION: Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java...

Insecure Deserialization

Apache Axis2/Java is vulnerable to Insecure Deserialization. The vulnerability is due to deserialization of untrusted data in the Tribes-based clustering component, where crafted serialized Java objects received over the clustering channel can trigger arbitrary code execution by unauthenticated...

CVE-2026-66713

A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, wit...

Deserialization of Untrusted Data

Overview org.apache.axis2:axis2-kernel is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. Affected versions of this package are vulnerable to Deserialization of Untrusted Data the Tribes-based clustering channel in...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

Apache Axis2/Java (versions through 2.0.0 ) is vulnerable to a Deserialization of Untrusted Data (CWE-502) flaw within the Tribes-based clustering component when running on Apache Tomcat . If Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering po...

EUVD-2026-49849

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713: Deserialization of Untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

PT-2026-65496

Name of the Vulnerable Software and Affected Versions Apache Axis2/Java versions prior to 2.0.1 Description An issue exists in the Tribes-based clustering component when running on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the...

Security Bulletin: IBM Tivoli Netcool Impact and IBM Tivoli Business Service Manager is vulnerable to man-in-the-middle attack due to Axis2 (CVE-2012-5785)

Summary Apache Axis2 is shipped with IBM Tivoli Netcool Impact and IBM Tivoli Business Service Manager as part of Web Services component. Information about security vulnerability affecting DB2 JDBC driver has been published in a security bulletin. Vulnerability Details CVEID:CVE-2012-5785...

CVE-2026-39920

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

EUVD-2026-25569

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...