# CVE-2026-66713: Apache Axis2/Java remote code execution in Tribes clustering component

Source: https://junglewise.ai/threats/cve-2026-66713-apache-axis2-java-remote-code-execution-in-tribes-clustering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-66713 · Severity: info · CVSS 9.8 · Published 2026-07-28

Apache Axis2/Java, a popular framework for building and deploying web services, contains a critical security flaw in its optional clustering component. If the clustering feature is enabled, an unauthenticated attacker can remotely take full control of the server by sending a specially crafted message to the cluster's communication port. This could lead to complete data theft, service disruption, or the installation of malware on the affected infrastructure.

Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-66713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66713 being exploited in the wild.

**How severe is CVE-2026-66713?** Informational severity, with a CVSS score of 9.8, published 28 July 2026.

**Which products and versions are affected?** Apache Software Foundation Axis2/Java 0 through 2.0.0.

**Is there a fix for CVE-2026-66713?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66713 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66713?** Check whether you run Apache Software Foundation Axis2/Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in the Tribes-based clustering component of Apache Axis2/Java. The flaw is located in the 'org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived' method, which fails to properly validate serialized Java objects received over the cluster channel. An unauthenticated remote attacker with network access to the clustering port can achieve arbitrary code execution by delivering a crafted serialized object. This vulnerability is only present when Tribes clustering is enabled (it is disabled by default). The issue has been addressed in version 2.0.1 by removing the clustering feature entirely.

## Affected products

- Apache Software Foundation Axis2/Java 0 through 2.0.0

## Timeline

- 2026-07-28: disclosed: Vulnerability disclosed by Apache Software Foundation
- 2026-07-28: advisory: NVD entry published

## References

- [https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15](https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15)
- [https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728](https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728)