This vulnerability is a Deserialization of Untrusted Data flaw in the Tribes‑based clustering component of Apache Axis2/Java. An attacker can send a specially crafted serialized Java object to the cluster channel when Tribes clustering is enabled, causing the server to deserialize it in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. The flaw satisfies CWE‑502 and allows an unauthenticated remote attacker to execute arbitrary code on the server.

Apache Axis2/Java versions up to and including 2.0.0 are affected. The clustering feature is enabled only when Tribes clustering is switched on, which is off by default. Users are advised to upgrade to version 2.0.1 or later where the clustering component has been removed entirely.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, and an EPSS score of 1%, implying that exploitation is considered possible but not highly likely in the current environment. It is not listed in the CISA KEV catalog. The attack vector is network‑based; an unauthenticated attacker with access to the cluster port can trigger the exploit. Successful exploitation would grant full code execution privileges on the affected system.