CVE-2026-66713

Name of the Vulnerable Software and Affected Versions Apache Axis2/Java versions prior to 2.0.1

Description An issue exists in the Tribes-based clustering component when running on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering port can execute arbitrary code. This is achieved by sending a crafted serialized Java object to the cluster channel, which is then deserialized in the messageReceived() function of org.apache.axis2.clustering.tribes.Axis2ChannelListener. Deserialization is the process of converting a stream of bytes back into an object in memory.

Recommendations Upgrade to version 2.0.1. As a temporary workaround, ensure that Tribes clustering remains disabled.