Loading story…
Apache disclosed CVE-2026-66713, a deserialization-of-untrusted-data flaw in the Tribes-based clustering component of Apache Axis2/Java that can lead to remote code execution. The issue affects Axis2/Java through version 2.0.0 and is reachable when deployed with Apache Tomcat Tribes clustering enabled; an unauthenticated attacker with network access to the clustering port can send a crafted serialized Java object that is deserialized in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Apache and CVE records describe the attack as requiring no privileges or user interaction, with a CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Apache recommends upgrading to Axis2/Java 2.0.1, which fixes the issue by removing the clustering feature entirely. A related repository commit deletes the modules/clustering component along with associated classes, tests, configuration references, and dependencies, reflecting the project's decision to eliminate the vulnerable functionality rather than patch it in place. The vulnerability was credited to liuhuajin of Huawei, and available advisories indicate no known exploitation at the time of publication; the feature is noted as off by default, limiting exposure to deployments that explicitly enabled Tribes clustering.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-66713 record was updated with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a CISA SSVC entry. The update stated there was no known exploitation, the attack was automatable, and the total technical impact was high.
Apache disclosed CVE-2026-66713, a deserialization of untrusted data vulnerability affecting Axis2/Java through version 2.0.0 in its Tribes-based clustering component. The advisory said unauthenticated remote code execution is possible when Tomcat Tribes clustering is enabled and recommended upgrading to version 2.0.1, which removes the clustering feature; the issue was credited to liuhuajin of Huawei.
A GitHub commit labeled "AXIS2-6097 Remove Clustering feature" removed the clustering component from Apache Axis2/Java, including related classes, tests, configuration references, and dependencies. The change is associated with version 2.0.1 and eliminates the vulnerable feature later cited in CVE-2026-66713.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecve.org
Open sourceseclists.org
Open sourcelists.apache.org
Open sourceopenwall.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat disclosed **CVE-2026-34486**, an unauthenticated remote code execution flaw in the Tribes clustering component after a fix for **CVE-2026-29146** introduced a fail-open regression in `EncryptInterceptor`. The earlier issue, rated Important, stemmed from the component's default use of CBC mode, which exposed it to a padding oracle attack in Tomcat `11.0.0-M1` through `11.0.18`, `10.1.0-M1` through `10.1.52`, and `9.0.13` through `9.0.115`; Apache directed users to upgrade to `11.0.20+`, `10.1.53+`, or `9.0.116+` to address it. A separate low-severity advisory, **CVE-2026-29129**, reported that configured TLS cipher preference order was not preserved in Tomcat `11.0.16` through `11.0.18`, `10.1.51` through `10.1.52`, and `9.0.114` through `9.0.115`. Research published by Striga showed that the March fix for the padding oracle bug moved a call in the receive path so that attacker-controlled bytes could still be forwarded for deserialization even when decryption failed. Because Tribes accepts unauthenticated messages on its cluster receiver port and deserializes them with Java `ObjectInputStream.readObject()` without an `ObjectInputFilter`, a remote attacker could send crafted unencrypted packets and achieve code execution if suitable gadget classes were present on the classpath. Apache fixed **CVE-2026-34486** in Tomcat `11.0.21`, `10.1.54`, and `9.0.117`; public reproduction material showed exploitation against the default receiver port `4000` using a deserialization gadget chain to create `/tmp/pwned` in a test container.
Aug 15, 2026
Apache disclosed **CVE-2026-43512**, a moderate-severity authentication bypass in Tomcat's DIGEST authenticator that can let any user unknown to the configured Realm authenticate if the supplied password is `"null"`. The flaw affects multiple supported branches, including Tomcat `11.0.0-M1` through `11.0.21`, `10.1.0-M1` through `10.1.54`, and `9.0.0.M1` through `9.0.117`, with older unsupported releases potentially affected. Apache advised users to upgrade to `11.0.22+`, `10.1.55+`, or `9.0.118+`. Apache also disclosed **CVE-2026-44417**, a moderate-severity flaw in the JMS transport component of Apache CXF caused by an incomplete fix for **CVE-2025-48913**. The remaining vulnerable code path can still lead to remote code execution when untrusted users are allowed to configure JMS. Affected releases include CXF JMS transport `4.2.0` before `4.2.1`, `4.0.0` before `4.1.6`, and all `3.6.x` versions before `3.6.11`; Apache said organizations should upgrade to `4.2.1`, `4.1.6`, or `3.6.11`.
Aug 28, 2026
Apache Commons Collections contained a critical unsafe-deserialization vulnerability, **CVE-2015-7501**, in its serializable `InvokerTransformer` component. An attacker able to supply crafted serialized Java objects to exposed endpoints—including JMX, RMI, or remote EJB services—could chain vulnerable classes with `sun.reflect.annotation.AnnotationInvocationHandler` to execute arbitrary code under the permissions of the affected Java application. The flaw affected Commons Collections 3.0 and 4.0 and exposed products and applications using the library, including WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS. Apache addressed the issue in Commons Collections versions 3.2.2 and 4.1 by preventing `InvokerTransformer` transformations following deserialization. Red Hat also issued a critical update for JBoss Operations Network 3.3.4, directing customers to shut down and patch every server individually, including each node in high-availability deployments. Organizations should identify applications that deserialize untrusted Java objects and either upgrade the library or apply vendor-provided patches.
Aug 29, 2026