BridgeHead FileStore versions earlier than 24A expose the Apache Axis2 administration module on network‑accessible endpoints. Attackers can log in with the hard‑coded default credentials, upload a malicious Java archive as a web service, and then issue SOAP requests that cause the host to execute arbitrary OS commands. The vulnerability stems from insecure default authentication (CWE‑1188) and remote code execution via web services (CWE‑1391). The impact includes full compromise of confidentiality, integrity, and availability on the affected system, as the attacker can run any command with the privileges of the service process.

BridgeHead Software FileStore versions prior to 24A. The affected product uses the Apache Axis2 framework for its administration console, and the security issue is present in all instances of the product released before the 24A update.

The CVSS score of 9.3 places this issue in the critical severity range. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is network‑based, requiring an unauthenticated user to access the exposed administration endpoint, which is typically reachable from external IP addresses. The existence of default credentials is a prerequisite for exploitation, and no additional setup beyond remote access is described in the advisory.