CVE-2026-90436
How to tell if CVE-2026-90436 (Apache Axis 1.x) is reachable in your environment
Reachable if an application that contains Apache Axis 1.x, through version 1.4, exposes its SOAP endpoint to a network an attacker can reach. No login is required, per Apache.
Apache will not release a fixed version of Axis 1.x, and many teams run it without knowing, inside another vendor's Java product. CVE-2026-90436 lets an unauthenticated attacker make Axis 1.x create Java objects of the attacker's choosing, which Apache says can lead to remote code execution. Apache also says authentication set up on an Axis service does not protect against it. Every Axis 1.x version through 1.4 is affected. CISA's ADP scores it 9.8, and NVD has not added its own score.
Exploitation has been reported. Previdian reports 2 exploitation attempts against its sensors from 1 IP address on November 12. Huntback reported on November 12 that attackers ran code on live N-central servers through Apache Axis, and Previdian, quoted by The Hacker News, ties that N-central chain to this CVE. N-able has not confirmed it and says it has seen no signs of compromise. It is not on CISA's Known Exploited Vulnerabilities catalog as of the November 10, 2026 release.
Two vendors have tied their products to this flaw so far. Atlassian says Confluence Data Center 1.x through 9.x is affected when the Remote API is turned on, and fixed it in 9.2.28. N-able's N-central is the product in the reported attacks, and N-able tells on-premises customers to make sure its Legacy API is disabled. Apache's own options are to migrate off Axis 1.x or rebuild it with the upstream patch.
Is it reachable for you?
What it is. Apache says Axis 1.x reads part of an incoming SOAP fault message and creates a Java object named in it, before checking whether the message should be trusted. With a suitable class on the application's classpath, Apache says, this leads to remote code execution. Apache also says the fault is processed before any per-service handlers run, so authentication handlers configured on a service do not protect against it. Apache credits José Apari-Pantigozo of OKIOK with the finding.
Affected, per Apache. All Apache Axis 1.x versions through 1.4. Axis 1.x is end of life, and Apache does not expect to release a fix. The fix exists only as upstream commit 41f3b4e. Apache Axis2/Java is a separate project and is not listed as affected.
Products known to bundle it. Atlassian Confluence Data Center 1.x through 9.x, when the "Remote API (XML-RPC & SOAP)" setting is enabled, per Atlassian; Confluence 10.x and Confluence Cloud are not affected. N-able N-central, the product in the reported attacks; see our N-central advisory. Debian ships Axis 1.4 as the libaxis-java package and lists it as vulnerable in bookworm, trixie and sid. Ubuntu lists its axis package as needing evaluation. Other Java products may bundle Axis 1.x without saying so.
Checks, in three tiers. The first decides whether you have it. The second decides exposure. The third decides priority. Run these only on systems your organization owns.
- Do you run anything that contains Axis 1.x? Search application servers and installed products for Axis 1.x library files, such as
axis.jaroraxis-1.4.jar, often inside aWEB-INF/libfolder. Software composition analysis tools and SBOMs list it under the Maven namesaxis:axisororg.apache.axis:axis. On Debian,dpkg -l libaxis-javashows the system package. Then check each vendor's advisory for the products you find. - Is its SOAP endpoint reachable? Apache says no login is needed, so any network path to an Axis SOAP endpoint counts. Check whether the product's SOAP or web services interface is turned on, and test from the internet and from user networks whether anything can reach it. On Confluence that means the Remote API setting. On N-central, N-able points to the Legacy API.
- What can the application reach? Code would run with the permissions of the Java application. Prioritize hosts like RMM servers and collaboration platforms, whose stored credentials and connections reach many other systems.
Compensating controls (test them, don't assume them)
There is no fixed Axis 1.x release. These are the options the vendors and Apache give.
- Apply the bundling vendor's fix. Atlassian fixed Confluence Data Center in 9.2.28 and recommends the latest version or a fixed LTS version.
- Turn off the SOAP interface the product exposes. Atlassian says to disable "Remote API (XML-RPC & SOAP)" if you cannot patch, and warns this may break scripts, automations and add-ons. N-able tells on-premises N-central customers to "Ensure Legacy API access is disabled in your environment." This only helps if nothing you depend on uses that interface.
- Migrate or rebuild, for software you maintain. Apache recommends moving to a different SOAP engine, such as Apache Axis2/Java, or using a build of Axis with commit 41f3b4e applied. Previdian advises validating internet-facing exposure while you do.
What to look for in logs
Apache has published no indicators of compromise. Huntback has published host and network indicators for the N-central attacks, linked under Sources. Atlassian says it "cannot confirm if your instances have been affected" and recommends checking for signs of compromise. General signals to review on hosts that run Axis 1.x are below.
- Unexpected processes started by the Java application server, such as shells, download tools or cryptocurrency miners.
- New files, scheduled tasks or services on the host that no administrator created.
- Outbound connections from the application server to addresses it does not normally contact.
FAQ
Am I exposed to CVE-2026-90436?
You may be if any application you run contains Apache Axis 1.x, through version 1.4, and its SOAP endpoint can be reached over the network. No login is needed, per Apache. Many products bundle Axis 1.x, so check vendor advisories as well as your own code.
Is CVE-2026-90436 being exploited?
Exploitation has been reported. Previdian reports 2 exploitation attempts against its sensors from 1 IP on November 12, and Huntback reported attacks on live N-central servers through Apache Axis the same day, which Previdian ties to this CVE. N-able has not confirmed it, and it is not on CISA KEV as of the November 10, 2026 catalog.
Is there a patch?
Apache will not release a fixed Axis 1.x. The fix exists only as an upstream commit. Vendors that bundle Axis ship their own fixes, such as Confluence Data Center 9.2.28.
Does authentication on my Axis service protect me?
No. Apache says the flaw is triggered before per-service handlers run, so authentication handlers configured on a service do not protect against it.
Is Apache Axis2 affected?
Apache's advisory lists only Axis 1.x through 1.4. Axis2/Java is the engine Apache recommends migrating to.
- Vendor
- Apache Software Foundation
- Product
- Apache Axis 1.x (end of life), including copies bundled inside other Java applications
- Affected versions
- All Apache Axis 1.x versions through 1.4, per Apache. Apache does not plan a fixed Axis 1.x release. Products that bundle Axis 1.x are affected until their vendor ships a fix; Atlassian lists Confluence Data Center 1.x through 9.x, fixed in 9.2.28
- Vulnerable component
- Apache Axis 1.x SOAP engine, where it handles inbound SOAP faults
- CVSS
- 9.8 Critical (CISA ADP, CVSS 3.1). NVD has not added its own score. Apache rates it critical without a score. Atlassian rates it 9.3 (CVSS 4.0) for Confluence Data Center
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CISA ADP)
- CWE
- Not published by Apache. Apache describes it as deserialization of an inbound SOAP fault that allows unauthenticated remote class instantiation
- Exploitation
- Reported, not on KEV
- CISA KEV added
- Patch
- No fixed Axis 1.x release. Apache recommends migrating to another SOAP engine, such as Apache Axis2/Java, or building Axis with upstream commit 41f3b4e applied. For products that bundle Axis, apply the vendor's fix, such as Confluence Data Center 9.2.28
Updates
Nov 12, 2026. First published. Apache disclosed the flaw on November 6 with no planned fixed release. Atlassian fixed Confluence Data Center in 9.2.28. Public exploit code against a lab setup since November 10. Previdian reports 2 exploitation attempts against its sensors; Huntback reports attacks on N-central servers through Axis, which Previdian ties to this CVE. Not on CISA KEV.
Sources
- Apache Axis announcement, CVE-2026-90436 (Nov 6, 2026)
- Upstream fix commit 41f3b4e
- CVE record CVE-2026-90436 (CNA Apache; 9.8 from CISA ADP) and NIST NVD (Awaiting Analysis, no NVD score, checked Nov 12)
- Atlassian, CVE-2026-90436 in Confluence Data Center (Nov 9, 2026)
- Previdian, CVE-2026-90436 exploitation attempts observed (sensor data, checked Nov 12, 2026)
- Huntback, attacks on live N-central servers (Nov 12, 2026; not confirmed by N-able)
- The Hacker News (Nov 12, 2026) (Previdian ties the N-central chain to CVE-2026-90436)
- N-able status, incident 202613 (Legacy API guidance; no signs of compromise, Nov 12, 2026)
- Debian tracker and Ubuntu tracker (checked Nov 12, 2026)
- Public exploit code, fixedbyreboot/CVE-2026-90436-POC (posted Nov 10, 2026, against a lab setup; read only, not run)
- CISA Known Exploited Vulnerabilities catalog (not listed; checked catalog version 2026.11.10)
We publish an advisory when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Advisories are updated as exploitation status changes.