CVE-2026-66713
Description
A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, with network access to the clustering port, to send a specially crafted message. Successful exploitation could lead to the execution of arbitrary code, giving the attacker full control over the affected system.
Statement
This flaw affects the Tribes based clustering feature of Apache Axis2/Java, which is disabled by default and only reachable when an administrator has explicitly enabled Tribes clustering and exposed the clustering port to untrusted networks. Exploitation requires the vulnerable org.apache.axis2:axis2-clustering module, containing org.apache.axis2.clustering.tribes.Axis2ChannelListener, to be present on the classpath. Red Hat has reviewed its supported product portfolio and confirmed that no currently shipping Red Hat product includes the Axis2 Tribes clustering module. Some Red Hat products bundle other, unrelated Apache Axis2 components, for example JAX-WS and kernel support jars, but these do not include the vulnerable clustering listener and are therefore not affected by this issue. Apache Tomcat itself, which some Red Hat products ship, is also not affected, as the vulnerable deserialization code resides entirely within Apache Axis2, not within Tomcat.
Mitigation
No currently supported Red Hat product ships the affected Apache Axis2 Tribes clustering module, org.apache.axis2:axis2-clustering, so no mitigation action is required for Red Hat products. For any independently deployed or third party installation of Apache Axis2 through version 2.0.0 with Tribes clustering enabled, disabling the Tribes clustering feature, or restricting network access to the clustering port to trusted hosts only, removes the attack vector. This issue was corrected upstream in Apache Axis2 by removing the clustering feature entirely, so standalone Apache Axis2 deployments should upgrade to a corrected version.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
AC:H reflects that exploitation requires Tribes-based clustering to be explicitly enabled, which is off by default per the upstream Apache advisory. This is a non-default configuration dependency outside the attackers control, consistent with CVSS Attack Complexity guidance for vulnerabilities that only manifest under specific configurations. This also aligns with precedent from CVE-2026-34486, a comparable Tomcat Tribes clustering deserialization RCE that was scored in the High range rather than Critical for the same reason.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data; Unexpected State
Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.
Availability
Technical Impact: DoS: Resource Consumption (CPU)
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.
Other
Technical Impact: Varies by Context
The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform unauthorized actions, such as generating a shell.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
