CVE-2026-66713

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66713", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-27T14:49:00.907Z", "datePublished": "2026-07-28T13:44:29.702Z", "dateUpdated": "2026-07-29T03:55:41.433Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Axis2/Java", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "liuhuajin of Huawei"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Deserialization</span> <span style=\"background-color: rgb(255, 255, 255);\">of</span> <span style=\"background-color: rgb(255, 255, 255);\">Untrusted</span> <span style=\"background-color: rgb(255, 255, 255);\">Data</span> <span style=\"background-color: rgb(255, 255, 255);\">(CWE-502)</span> <span style=\"background-color: rgb(255, 255, 255);\">in</span> <span style=\"background-color: rgb(255, 255, 255);\">the</span> <span style=\"background-color: rgb(255, 255, 255);\">Tribes-based</span> <span style=\"background-color: rgb(255, 255, 255);\">clustering</span> <span style=\"background-color: rgb(255, 255, 255);\">component</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">(only</span> <span style=\"background-color: rgb(255, 255, 255);\">when</span> <span style=\"background-color: rgb(255, 255, 255);\">Tribes</span> <span style=\"background-color: rgb(255, 255, 255);\">clustering</span> <span style=\"background-color: rgb(255, 255, 255);\">is</span> <span style=\"background-color: rgb(255, 255, 255);\">enabled,</span> <span style=\"background-color: rgb(255, 255, 255);\">which</span> <span style=\"background-color: rgb(255, 255, 255);\">is</span> <span style=\"background-color: rgb(255, 255, 255);\">off</span> <span style=\"background-color: rgb(255, 255, 255);\">by</span> <span style=\"background-color: rgb(255, 255, 255);\">default)</span> <span style=\"background-color: rgb(255, 255, 255);\">allows</span> <span style=\"background-color: rgb(255, 255, 255);\">an</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;unauthenticated remote attacker with network access to the clustering port to</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;execute</span> <span style=\"background-color: rgb(255, 255, 255);\">arbitrary</span> <span style=\"background-color: rgb(255, 255, 255);\">code</span> <span style=\"background-color: rgb(255, 255, 255);\">via</span> <span style=\"background-color: rgb(255, 255, 255);\">a</span> <span style=\"background-color: rgb(255, 255, 255);\">crafted</span> <span style=\"background-color: rgb(255, 255, 255);\">serialized</span> <span style=\"background-color: rgb(255, 255, 255);\">Java</span> <span style=\"background-color: rgb(255, 255, 255);\">object</span> <span style=\"background-color: rgb(255, 255, 255);\">delivered</span> <span style=\"background-color: rgb(255, 255, 255);\">to</span> <span style=\"background-color: rgb(255, 255, 255);\">the</span> <span style=\"background-color: rgb(255, 255, 255);\">cluster</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">channel</span> <span style=\"background-color: rgb(255, 255, 255);\">and</span> <span style=\"background-color: rgb(255, 255, 255);\">deserialized</span> <span style=\"background-color: rgb(255, 255, 255);\">in</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;recommended</span> <span style=\"background-color: rgb(255, 255, 255);\">to</span> <span style=\"background-color: rgb(255, 255, 255);\">upgrade</span> <span style=\"background-color: rgb(255, 255, 255);\">to</span> <span style=\"background-color: rgb(255, 255, 255);\">version</span> <span style=\"background-color: rgb(255, 255, 255);\">2.0.1,</span> <span style=\"background-color: rgb(255, 255, 255);\">which</span> <span style=\"background-color: rgb(255, 255, 255);\">fixes</span> <span style=\"background-color: rgb(255, 255, 255);\">this</span> <span style=\"background-color: rgb(255, 255, 255);\">issue</span> <span style=\"background-color: rgb(255, 255, 255);\">by</span> <span style=\"background-color: rgb(255, 255, 255);\">removing</span> <span style=\"background-color: rgb(255, 255, 255);\">the</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;clustering feature entirely.</span><br>\n<br>\n\n<br>"}], "value": "Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component\n\n \u00a0in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\n\n \u00a0(only when Tribes clustering is enabled, which is off by default) allows an\n\n \u00a0unauthenticated remote attacker with network access to the clustering port to\n\n \u00a0execute arbitrary code via a crafted serialized Java object delivered to the cluster\n\n \u00a0channel and deserialized in\n\n \u00a0org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\n\n \u00a0recommended to upgrade to version 2.0.1, which fixes this issue by removing the\n\n \u00a0clustering feature entirely."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-28T13:44:29.702Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Axis2/Java: deserialization of untrusted Data", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-66713"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T03:55:41.433Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/28/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-28T14:53:41.497Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/28/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-28T14:53:41.497Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-66713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T14:43:46.318199Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:43:41.645Z"}}], "cna": {"title": "Apache Axis2/Java: deserialization of untrusted Data", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "liuhuajin of Huawei"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Axis2/Java", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component\n\n \u00a0in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\n\n \u00a0(only when Tribes clustering is enabled, which is off by default) allows an\n\n \u00a0unauthenticated remote attacker with network access to the clustering port to\n\n \u00a0execute arbitrary code via a crafted serialized Java object delivered to the cluster\n\n \u00a0channel and deserialized in\n\n \u00a0org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\n\n \u00a0recommended to upgrade to version 2.0.1, which fixes this issue by removing the\n\n \u00a0clustering feature entirely.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Deserialization</span> <span style=\"background-color: rgb(255, 255, 255);\">of</span> <span style=\"background-color: rgb(255, 255, 255);\">Untrusted</span> <span style=\"background-color: rgb(255, 255, 255);\">Data</span> <span style=\"background-color: rgb(255, 255, 255);\">(CWE-502)</span> <span style=\"background-color: rgb(255, 255, 255);\">in</span> <span style=\"background-color: rgb(255, 255, 255);\">the</span> <span style=\"background-color: rgb(255, 255, 255);\">Tribes-based</span> <span style=\"background-color: rgb(255, 255, 255);\">clustering</span> <span style=\"background-color: rgb(255, 255, 255);\">component</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">(only</span> <span style=\"background-color: rgb(255, 255, 255);\">when</span> <span style=\"background-color: rgb(255, 255, 255);\">Tribes</span> <span style=\"background-color: rgb(255, 255, 255);\">clustering</span> <span style=\"background-color: rgb(255, 255, 255);\">is</span> <span style=\"background-color: rgb(255, 255, 255);\">enabled,</span> <span style=\"background-color: rgb(255, 255, 255);\">which</span> <span style=\"background-color: rgb(255, 255, 255);\">is</span> <span style=\"background-color: rgb(255, 255, 255);\">off</span> <span style=\"background-color: rgb(255, 255, 255);\">by</span> <span style=\"background-color: rgb(255, 255, 255);\">default)</span> <span style=\"background-color: rgb(255, 255, 255);\">allows</span> <span style=\"background-color: rgb(255, 255, 255);\">an</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;unauthenticated remote attacker with network access to the clustering port to</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;execute</span> <span style=\"background-color: rgb(255, 255, 255);\">arbitrary</span> <span style=\"background-color: rgb(255, 255, 255);\">code</span> <span style=\"background-color: rgb(255, 255, 255);\">via</span> <span style=\"background-color: rgb(255, 255, 255);\">a</span> <span style=\"background-color: rgb(255, 255, 255);\">crafted</span> <span style=\"background-color: rgb(255, 255, 255);\">serialized</span> <span style=\"background-color: rgb(255, 255, 255);\">Java</span> <span style=\"background-color: rgb(255, 255, 255);\">object</span> <span style=\"background-color: rgb(255, 255, 255);\">delivered</span> <span style=\"background-color: rgb(255, 255, 255);\">to</span> <span style=\"background-color: rgb(255, 255, 255);\">the</span> <span style=\"background-color: rgb(255, 255, 255);\">cluster</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">channel</span> <span style=\"background-color: rgb(255, 255, 255);\">and</span> <span style=\"background-color: rgb(255, 255, 255);\">deserialized</span> <span style=\"background-color: rgb(255, 255, 255);\">in</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;recommended</span> <span style=\"background-color: rgb(255, 255, 255);\">to</span> <span style=\"background-color: rgb(255, 255, 255);\">upgrade</span> <span style=\"background-color: rgb(255, 255, 255);\">to</span> <span style=\"background-color: rgb(255, 255, 255);\">version</span> <span style=\"background-color: rgb(255, 255, 255);\">2.0.1,</span> <span style=\"background-color: rgb(255, 255, 255);\">which</span> <span style=\"background-color: rgb(255, 255, 255);\">fixes</span> <span style=\"background-color: rgb(255, 255, 255);\">this</span> <span style=\"background-color: rgb(255, 255, 255);\">issue</span> <span style=\"background-color: rgb(255, 255, 255);\">by</span> <span style=\"background-color: rgb(255, 255, 255);\">removing</span> <span style=\"background-color: rgb(255, 255, 255);\">the</span>\n<br><span style=\"background-color: rgb(255, 255, 255);\"> &nbsp;clustering feature entirely.</span><br>\n<br>\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-28T13:44:29.702Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66713", "state": "PUBLISHED", "dateUpdated": "2026-07-29T03:55:41.433Z", "dateReserved": "2026-07-27T14:49:00.907Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-07-28T13:44:29.702Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Axis2/Java", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:axis2\\/java:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D56E1EE-CB90-419D-BA8B-178CB1AD8BC3", "versionEndExcluding": "2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component\n\n \u00a0in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\n\n \u00a0(only when Tribes clustering is enabled, which is off by default) allows an\n\n \u00a0unauthenticated remote attacker with network access to the clustering port to\n\n \u00a0execute arbitrary code via a crafted serialized Java object delivered to the cluster\n\n \u00a0channel and deserialized in\n\n \u00a0org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\n\n \u00a0recommended to upgrade to version 2.0.1, which fixes this issue by removing the\n\n \u00a0clustering feature entirely."}, {"lang": "es", "value": "Deserializaci\u00f3n de datos no confiables (CWE-502) en el componente de clustering basado en Tribes en Apache Software Foundation Apache Axis2/Java hasta 2.0.0 en Apache Tomcat (solo cuando el clustering de Tribes est\u00e1 habilitado, que est\u00e1 desactivado por defecto) permite a un atacante remoto no autenticado con acceso de red al puerto de clustering ejecutar c\u00f3digo arbitrario a trav\u00e9s de un objeto Java serializado manipulado entregado al canal del cluster y deserializado en org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.0.1, que soluciona este problema al eliminar la caracter\u00edstica de clustering por completo."}], "id": "CVE-2026-66713", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66713", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-28T15:17:50.430", "references": [{"source": "security@apache.org", "tags": ["Patch"], "url": "https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/28/2"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.axis2/axis2-java-core: tomcat: Apache Axis2/Java: Remote code execution via deserialization of untrusted data in Tribes clustering", "id": "2508125", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508125"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component\n\u00a0in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\n\u00a0(only when Tribes clustering is enabled, which is off by default) allows an\n\u00a0unauthenticated remote attacker with network access to the clustering port to\n\u00a0execute arbitrary code via a crafted serialized Java object delivered to the cluster\n\u00a0channel and deserialized in\n\u00a0org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\n\u00a0recommended to upgrade to version 2.0.1, which fixes this issue by removing the\n\u00a0clustering feature entirely.", "A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, with network access to the clustering port, to send a specially crafted message. Successful exploitation could lead to the execution of arbitrary code, giving the attacker full control over the affected system."], "mitigation": {"lang": "en:us", "value": "No currently supported Red Hat product ships the affected Apache Axis2 Tribes clustering module, org.apache.axis2:axis2-clustering, so no mitigation action is required for Red Hat products. For any independently deployed or third party installation of Apache Axis2 through version 2.0.0 with Tribes clustering enabled, disabling the Tribes clustering feature, or restricting network access to the clustering port to trusted hosts only, removes the attack vector. This issue was corrected upstream in Apache Axis2 by removing the clustering feature entirely, so standalone Apache Axis2 deployments should upgrade to a corrected version."}, "name": "CVE-2026-66713", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "tomcat9", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "tomcat6", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "critical", "package_name": "tomcat10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "critical", "package_name": "tomcat11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "axis2-kernel", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Not affected", "package_name": "jws5-tomcat", "product_name": "Red Hat JBoss Web Server 5"}], "public_date": "2026-07-28T13:44:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66713\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66713\nhttp://www.openwall.com/lists/oss-security/2026/07/28/2\nhttps://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15\nhttps://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728"], "statement": "This flaw affects the Tribes based clustering feature of Apache Axis2/Java, which is disabled by default and only reachable when an administrator has explicitly enabled Tribes clustering and exposed the clustering port to untrusted networks. Exploitation requires the vulnerable org.apache.axis2:axis2-clustering module, containing org.apache.axis2.clustering.tribes.Axis2ChannelListener, to be present on the classpath. Red Hat has reviewed its supported product portfolio and confirmed that no currently shipping Red Hat product includes the Axis2 Tribes clustering module. Some Red Hat products bundle other, unrelated Apache Axis2 components, for example JAX-WS and kernel support jars, but these do not include the vulnerable clustering listener and are therefore not affected by this issue. Apache Tomcat itself, which some Red Hat products ship, is also not affected, as the vulnerable deserialization code resides entirely within Apache Axis2, not within Tomcat.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Axis2/Java", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_axis2/java", "vendor": "apache"}], "created": "2026-07-28T20:34:34.714280+00:00", "updated": "2026-08-02T09:15:03.948303+00:00", "vendors": ["apache", "apache$PRODUCT$apache_axis2/java"]}