Is CVE-2026-120761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120761 being exploited in the wild.

How severe is CVE-2026-120761?

Informational severity, published 9 November 2026.

Is there a fix for CVE-2026-120761?

Yes: fixed in 2.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120761 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120761?

Check whether you run Apache Axis2\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120761: Apache Axis2 XML External Entity injection in WSDL import resolution

CVE-2026-120761 · Severity: info · Published 2026-11-09

Apache Axis2 is a Java-based framework for building web services. When Axis2 loads a WSDL file from a URL, it processes imported documents using an XML parser that permits external entity references, allowing an attacker who controls the WSDL or its imported documents to read local files from the server or force the application to make unauthorized network requests.

Technologies: Apache Axis2\. Vendors: Apache.

Quick answers

Is CVE-2026-120761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120761 being exploited in the wild.
How severe is CVE-2026-120761?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Apache Axis2\ through 2.0.1.
Is there a fix for CVE-2026-120761?: Yes: fixed in 2.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120761 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120761?: Check whether you run Apache Axis2\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.2

Technical details

An XXE (XML External Entity) vulnerability exists in Axis2's WSDL import resolution mechanism. When ServiceClient or AxisService.createClientSideAxisService construct an AxisService from a WSDL URL, the wsdl4j library's XML parser processes DOCTYPE declarations and external entities without restriction. An attacker controlling the WSDL or any document it imports (via wsdl:import or xsd:import) can inject entity declarations to read arbitrary files or trigger outbound network connections.

Affected products

Apache Axis2 through 2.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.