## Overview
CVE-2026-90436 affects Apache Axis 1.x, which is now end-of-life (EOL). This vulnerability allows unauthenticated remote class instantiation through deserialization of an inbound SOAP fault. As reported by 2-Spyware, the issue has garnered attention due to its potential for exploitation.
## Technical Details
The vulnerability arises when a SOAP <Fault> contains a <detail><exceptionName> element. Axis loads the specified class and, if a String <data> element is present, instantiates it via its String constructor. This occurs before the system checks if the fault is an AxisFault, allowing the class's static initializer to run. If a malicious class is present in the application's classpath, this can lead to remote code execution. The vulnerability affects all versions of Apache Axis 1.x up to 1.4.
## Impact
Exploitation of this vulnerability can lead to severe consequences, including unauthorized remote code execution. Since Apache Axis 1.x is EOL, there will be no official patches or updates from the Apache Software Foundation to address this issue. This lack of support increases the urgency for organizations still using Axis 1.x to take immediate action.
## Mitigation
Defenders should migrate to a different SOAP engine, such as Apache Axis 2 or an alternative Java-based solution. If migration is not feasible, users can apply a specific patch from the Apache Axis GitHub repository. However, reliance on an unsupported product poses significant risks, and organizations should prioritize transitioning to supported software.
CSURFACE Threat Sensor