CVE-2026-66713: Apache Axis2/Java Tomcat Tribes deserialization RCE
TL;DR - Critical unauthenticated RCE in Apache Axis2/Java through 2.0.0. - Exploitable only on Tomcat with Tribes clustering enabled and reachable. - Upgrade to 2.0.1 or disable clustering immediately.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-66713 |
| CVSS Score | 9.8 Critical |
| Attack Vector | Network |
| Auth Required | No |
| Patch Available | Yes, upgrade to 2.0.1 |
CVE-2026-66713 is a critical remote code execution vulnerability in Apache Axis2/Java. The issue stems from unsafe deserialization in the Tribes-based clustering component when Axis2/Java is deployed on Apache Tomcat and clustering is enabled. An attacker who can reach the clustering port can send a crafted serialized Java object and potentially execute arbitrary code without authentication.
The exposure qualifier matters. This is not a blanket “all Axis2 instances are vulnerable” situation. The issue applies to Apache Axis2/Java through 2.0.0, but exploitation requires a specific deployment pattern: Tomcat, Tribes clustering enabled, and network reachability to the clustering channel. Clustering is described as off by default, so defenders should prioritize identifying non-default clustered deployments first.
What Is This Vulnerability?
At its core, CVE-2026-66713 is a CWE-502 deserialization of untrusted data flaw. The vulnerable code path is identified as org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. In affected deployments, that listener accepts data delivered over the cluster channel and deserializes Java objects originating from the remote sender. If an attacker can supply a malicious serialized object, they may be able to trigger code execution during deserialization or subsequent object handling.
This class of bug is dangerous because Java native serialization has a long history of gadget-chain abuse. When a system deserializes attacker-controlled input, the application may invoke methods on unexpected classes, trigger side effects during object reconstruction, or execute chains already present on the classpath. The NVD description does not enumerate a specific gadget chain, and defenders should not assume one particular library is required. The main defensive takeaway is simpler: if the clustering endpoint is reachable and the feature is enabled, untrusted serialized data can reach a deserialization sink in Axis2.
Technical Notes
The vulnerable path called out in the public description is:
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived
A simplified conceptual flow for the risk looks like this:
Attacker -> Tomcat Tribes cluster port -> Axis2ChannelListener.messageReceived(...)
-> deserialize attacker-controlled object
-> gadget execution / arbitrary code execution
Because the vendor fix reportedly removes the clustering feature entirely in 2.0.1, defenders should treat the feature itself as the unsafe boundary, not just one malformed message case.
Who Is Affected?
The affected product is Apache Axis2/Java through version 2.0.0. Based on the available primary-source description, the vulnerability is relevant only when Axis2/Java is running on Apache Tomcat and the Tribes-based clustering feature is enabled. The fixed version is 2.0.1.
The exact affected range should be stated conservatively as: Apache Axis2/Java through 2.0.0, with exploitation conditions of Apache Tomcat deployment and Tribes clustering enabled. There is not enough evidence in the provided sources to claim impact to non-Tomcat containers, non-clustered deployments, or all Axis2 installations regardless of configuration. If you do not know whether clustering is enabled in your environment, you should assume risk until you verify the runtime and configuration state.
In practice, the organizations most likely to be affected are those that deliberately enabled clustering for high availability or state distribution across Tomcat nodes. Because clustering is off by default, single-node or default Axis2 installations may not be exposed. However, many enterprises forget about internal cluster ports because they are not internet-facing by design. That makes internal segmentation and east-west reachability an important part of triage.
Technical Notes
Files and settings to review may include Tomcat cluster-related configuration such as:
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
And Axis2 deployments or documentation referencing clustering support. If you find evidence that Tomcat Tribes is enabled for an Axis2 deployment, treat the system as affected until upgraded to 2.0.1 or the feature is removed.
CVSS Score Breakdown
The published severity is CVSS 9.8 Critical. The compact source data provided here includes the score but not the full vector string. Even without the exact vector, the score aligns with the public description: unauthenticated exploitation, remote network reachability, low attack complexity in exposed deployments, and full remote code execution impact.
From a defender’s perspective, the most important score components are straightforward. The attack is described as network-reachable through the clustering port, no authentication is required, and the result is arbitrary code execution. That combination typically drives high impact across confidentiality, integrity, and availability. If the clustering listener is reachable from untrusted segments, this should be handled as an urgent patching and containment issue even though clustering is off by default.
A common mistake is to downplay a 9.8 issue because it requires a non-default feature. That would be the wrong operational conclusion. The right interpretation is that broad exposure may be narrower, but any deployment matching the conditions is high risk. Severity should be assessed against actual environment exposure, not default installation assumptions.
Exploitation Status
As of 2026-07-28, there is no CISA KEV listing for CVE-2026-66713 in the provided research, so there is no CISA-confirmed evidence of exploitation in the wild from that source. The same research also does not confirm a public proof of concept. That means defenders should state the status precisely: no public PoC confirmed from the cited sources, and no confirmed in-the-wild exploitation from KEV.
That said, absence of confirmation is not evidence of safety. Deserialization flaws that enable unauthenticated RCE on reachable services are often attractive exploit targets. If your clustering port is exposed beyond a tightly controlled management network, you should assume exploit development is plausible and prioritize remediation accordingly. For SMBs and lean IT teams, the practical rule is simple: if you have a vulnerable clustered deployment, act as though exploitation could emerge quickly.
Because the issue is newly published and the vulnerable code path is identified, defenders should monitor for exploit chatter, scanning activity against cluster ports, and unusual process launches on affected Tomcat hosts. If your change window is delayed, compensating controls become important immediately.
Technical Notes
Known status based on the provided sources:
- Public PoC: Not confirmed
- Active exploitation in the wild: Not confirmed by CISA KEV
- KEV status: Not listed
- Patch: Available in 2.0.1
If no exploitation data is available, defenders should assume: 1. exploit attempts may follow public disclosure, 2. internal-only ports are still reachable by compromised hosts, 3. segmentation failures can turn “non-internet-facing” into “reachable enough.”
How to Detect It
Start by identifying all Axis2/Java deployments and narrowing to those running on Tomcat with clustering enabled. Asset inventory, container manifests, startup scripts, and Tomcat configuration reviews are more reliable than vulnerability scanner banners here because the vulnerable condition depends on deployment topology and feature state. If you cannot verify whether Tribes clustering is enabled, treat the host as potentially exposed until you inspect its configuration.
On the host and network side, detection should focus on unexpected traffic to Tomcat clustering ports, unusual serialization-related errors, and post-exploitation behavior on the Java process. The public description does not provide a canonical IOC set, so defenders need to combine configuration awareness with anomaly detection. Any cluster-channel traffic originating from non-cluster peers should be considered suspicious.
Technical Notes
Example log and config hunting patterns:
# Look for Tomcat cluster configuration
grep -R "SimpleTcpCluster\|org.apache.catalina.ha.tcp" /etc/tomcat* /opt/tomcat* 2>/dev/null
# Look for Axis2 clustering references
grep -R "axis2.clustering\|Axis2ChannelListener\|tribes" /opt /srv /var/lib/tomcat* 2>/dev/null
Example process and socket review:
# Identify Java services listening on likely cluster-related ports
ss -lntp | grep java
# Correlate Java PID with Tomcat
ps -ef | grep -E "tomcat|catalina|axis2" | grep -v grep
Example network detection concept for east-west monitoring:
Alert on inbound connections to Tomcat cluster ports from non-approved cluster members.
Condition:
- Destination host runs Tomcat/Axis2
- Destination port matches configured Tribes cluster listener
- Source IP not in approved cluster node allowlist
Example SIEM hunting query pattern, adapted generically:
SELECT timestamp, src_ip, dest_ip, dest_port, process_name
FROM network_events
WHERE process_name IN ('java','java.exe')
AND dest_port IN (4000, 45564) -- example only; verify your actual cluster ports
AND dest_ip IN (SELECT ip FROM assets WHERE tags LIKE '%axis2%' OR tags LIKE '%tomcat%');
The sample ports above are examples only, because the specific clustering port is environment-dependent. Do not assume defaults; verify your actual Tomcat Tribes configuration and alert on unauthorized sources reaching that port.
Mitigation and Patching
The vendor-recommended fix is to upgrade to Apache Axis2/Java 2.0.1. The important operational detail is that 2.0.1 reportedly fixes the issue by removing the clustering feature entirely, not by narrowly sanitizing one code path. If your environment depends on Axis2 clustering, plan for functional impact and validate replacement architecture before or immediately after the upgrade.
If an immediate upgrade is not possible, the most important workaround is to disable Tribes clustering and block network access to the clustering port so only approved cluster members, if any, can reach it. Since the feature is off by default, many teams may discover they do not actually need it. Removing or disabling clustering may be a faster short-term control than waiting for a broader application release cycle.
Defenders should also enforce strict segmentation around Tomcat nodes, especially for internal traffic. A deserialization RCE reachable only from “inside the network” is still serious in environments where workstation compromise, VPN access, or lateral movement are realistic. As a stopgap, isolate vulnerable servers from user subnets and untrusted internal segments.
Technical Notes
Upgrade guidance will vary by packaging method, but the target version is explicit:
# Verify current Axis2 version in your deployment artifact directories
find /opt /srv /var/lib/tomcat* -type f | grep -E 'axis2.*(jar|war)$'
If you deploy Axis2/Java via application artifacts, upgrade the application bundle or libraries to 2.0.1 through your normal build/deployment pipeline. For example, if your environment uses Maven-managed dependencies, update the Axis2 version to 2.0.1 in your build configuration and redeploy the application.
Example dependency change:
<dependency>
<groupId>org.apache.axis2</groupId>
<artifactId>axis2-kernel</artifactId>
<version>2.0.1</version>
</dependency>
Example workaround steps on Tomcat hosts:
# Back up Tomcat server configuration
cp /opt/tomcat/conf/server.xml /opt/tomcat/conf/server.xml.bak.$(date +%F)
# Inspect for cluster configuration
grep -n "Cluster\|SimpleTcpCluster" /opt/tomcat/conf/server.xml
# After removing or commenting the Cluster block, restart Tomcat
systemctl restart tomcat
Host firewall example to restrict the cluster port until remediation is complete:
# Example only: replace 45564 with your actual configured cluster port
iptables -A INPUT -p tcp --dport 45564 -s <approved-cluster-node-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 45564 -j DROP
If the exact package upgrade command for your environment is unknown, do not guess. Confirm whether Axis2 is installed from source, embedded in an application, bundled in a WAR, or managed through a dependency repository, then execute the appropriate 2.0.1 upgrade path.
References
Primary reference material identifies CVE-2026-66713 as a deserialization of untrusted data flaw in Apache Axis2/Java through 2.0.0, exploitable on Apache Tomcat when Tribes clustering is enabled. The vulnerable code path and fix version are explicitly described in the published record and associated references.
Because some reference pages may require manual review to access full advisory text or code diffs, defenders should preserve both the vulnerability record and the vendor-linked references in their internal ticketing or change records. This is especially important because the fix removes functionality, which may affect service design decisions.
- NVD record for CVE-2026-66713
- Apache Axis2/Java fix commit:
https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15 - Apache mailing list advisory:
https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728 - Openwall oss-security reference:
http://www.openwall.com/lists/oss-security/2026/07/28/2
For further understanding of related vulnerabilities, you can refer to our articles on what is ransomware and the OWASP API Security Top 10.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.