Apache Axis 1.x (EOL) vulnerabilities

Latest Apache Axis 1.x (EOL) CVEs

Newest publication first

1. CVE-2026-90436 Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

   Published 2026-11-06

   Critical·CVSS 9.8 EPSS 1.1%

   ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.