Is CVE-2026-120832 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120832 being exploited in the wild.

How severe is CVE-2026-120832?

Informational severity, published 9 November 2026.

Is there a fix for CVE-2026-120832?

Yes: fixed in 2.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120832 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120832?

Check whether you run Apache Axis2\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120832: Apache Axis2 server-side request forgery in WSDL processing

CVE-2026-120832 · Severity: info · Published 2026-11-09

Apache Axis2 is a web services framework that builds service descriptions from WSDL files. A server-side request forgery vulnerability allows an attacker who controls a WSDL or schema file to make an Axis2 application send HTTP requests to arbitrary internal or external hosts, potentially exposing internal services or exfiltrating sensitive data.

Technologies: Apache Axis2\. Vendors: Apache.

Quick answers

Is CVE-2026-120832 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120832 being exploited in the wild.
How severe is CVE-2026-120832?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Apache Axis2\ through 2.0.1.
Is there a fix for CVE-2026-120832?: Yes: fixed in 2.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120832 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120832?: Check whether you run Apache Axis2\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.2

Technical details

When Axis2 processes WSDL files via ServiceClient, AxisService.createClientSideAxisService, or WSDLToAxisServiceBuilder, it fetches absolute URLs from wsdl:import locations and xsd:import/xsd:include schemaLocations without validating the host or scheme; AAR and WAR deployment resolvers also pass unvalidated schema locations to the network. An attacker controlling the WSDL or schema can exploit this to force SSRF attacks. The issue is fixed in version 2.0.2.

Affected products

Apache Axis2 through 2.0.1

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.