CVE-2026-66713

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component

in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat

(only when Tribes clustering is enabled, which is off by default) allows an

unauthenticated remote attacker with network access to the clustering port to

execute arbitrary code via a crafted serialized Java object delivered to the cluster

channel and deserialized in

org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are

recommended to upgrade to version 2.0.1, which fixes this issue by removing the

clustering feature entirely.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jul 28, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-66726.4The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes CVE-2026-667206.5The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 CVE-2026-667212.7Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permissio CVE-2026-667227.2Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin CVE-2026-667237.0MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does n CVE-2026-667245.3MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. The CVE-2026-667297.5facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remot CVE-2026-66736.4Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect install CVE-2026-667307.5facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote a CVE-2026-667317.5facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthe CVE-2026-667325.9Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established conne CVE-2026-667337.5Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allo