Apache Axis 1.x, an end‑of‑life SOAP engine, contains an unprotected deserialization flaw where a SOAP fault containing an exceptionName and optional data string causes the engine to load and instantiate the referenced class before authenticating the request. This triggers a static initializer or constructor of the class, allowing an attacker to execute arbitrary code on the host running the Axis service. The vulnerability does not require any prior authentication and works against any class present on the application’s classpath, so a suitable payload can be provided by the attacker to trigger full code execution.

The flaw exists in all publicly released Apache Axis 1.x versions up to and including 1.4. The affected product is Apache Axis 1.x, a SOAP runtime no longer supported or maintained by the Apache Software Foundation. Any application or service that incorporates this engine and is reachable over a network could be exposed.

The vulnerability is high severity, as it permits remote code execution without authentication. No CVSS score is provided in the CVE data, and the EPSS score is not available, but the lack of authentication checks and the fact that the fault handling occurs before any service‑specific authentication handlers runs increase the likelihood of exploitation in environments where Axis 1.x is publicly accessible. The CVE is not listed in the CISA KEV catalog, however the risk remains significant due to the critical nature of the flaw and the ubiquity of SOAP services that may still use Axis 1.x.