CVE-2026-66713
Apache Axis2/Java versions up to 2.0.0 contain a critical flaw that lets an attacker run arbitrary code by sending a crafted serialized Java object to the clustering channel when Tribes clustering is enabled. The vulnerability stems from unsafe deserialization of untrusted data. Upgrading to 2.0.1 removes the clustering feature and fixes the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Axis2/Java 2.0.0 and earlier on Apache Tomcat when Tribes clustering is enabled (the feature is off by default).
Real-world impact
An attacker who can reach the clustering port can execute any code on the server, potentially taking full control, stealing data, or disrupting services.
Why this severity
The CVSS score of 9.8 reflects that the flaw is remotely exploitable without authentication, grants full code execution, and offers no practical mitigations other than disabling clustering or applying the vendor patch.
What to do about it
- 01Upgrade Apache Axis2/Java to version 2.0.1 or later.
- 02Restart the Axis2 service to apply the change.
- ›If an upgrade is not immediately possible, disable Tribes clustering to prevent the vulnerability from being triggered.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.