CVE-2026-66713
Severity CVSS v4.0:
Pending analysis
Type:
CWE-502
Deserialization of Untrusted Dat
Publication date:
28/07/2026
Last modified:
28/07/2026
Description
Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component<br />
<br />
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat<br />
<br />
(only when Tribes clustering is enabled, which is off by default) allows an<br />
<br />
unauthenticated remote attacker with network access to the clustering port to<br />
<br />
execute arbitrary code via a crafted serialized Java object delivered to the cluster<br />
<br />
channel and deserialized in<br />
<br />
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are<br />
<br />
recommended to upgrade to version 2.0.1, which fixes this issue by removing the<br />
<br />
clustering feature entirely.