CVE-2026-120761

CriticalCVSS 9.1/10Last modified Nov 12, 2026

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-611

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 9, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-120777.5The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versioCVE-2026-1207757.2Tanium addressed a heap-based buffer overflow vulnerability in Deploy.CVE-2026-1207787.3Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locallyCVE-2026-1207799.6Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a netwoCVE-2026-1207808.3Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-1207827.8Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security featureCVE-2026-1207836.4Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1207858.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207868.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207888.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207898.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-120796.5The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and includin
CVE-2026-120761: Critical severity, CVSS 9.1 | Vulnix