CVE-2026-123779

Apache Axis2/Java versions through 2.0.1 are vulnerable to a Direct Request ('Forced Browsing') vulnerability. The exposeServiceMetadata parameter was improperly enforced, only applying to ?wsdl, ?wsdl2, and ?xsd queries. Consequently, services with this parameter disabled still disclosed sensiti...

EUVD-2026-119978

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...