# CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName > CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName. CVSS n/a. Canonical: https://rewindex.com/cve/CVE-2026-90436 Last updated: 2026-11-06T19:17:58Z - Published: 2026-11-06 15:37 UTC · Updated: 2026-11-06 19:17 UTC · Assigner: apache - CVSS: n/a · Severity: Not scored - EPSS: 0.57%, 47th percentile (scored 2026-11-10) - CISA KEV: no - CWE: CWE-470 ## Description \*\* UNSUPPORTED WHEN ASSIGNED \*\* Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP \ carries a \\ element, Axis loads the named class and, if a String \ element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem. ## Affected vendors and products - Apache Software Foundation: Apache Axis 1.x (EOL) ## Tracked companies - [Confluence](https://rewindex.com/company/confluence.md) ## References - [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-90436) - [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-90436) - [https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd](https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd) - [https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz](https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ --- Canonical: https://rewindex.com/cve/CVE-2026-90436 · Markdown: https://rewindex.com/cve/CVE-2026-90436.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-90436 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T04:59:06.602Z