CVE-2026-66713: Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when

criticalCVSS 9.8CVE-2026-66713

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated remote attacker with network access to the clustering port to execute arbitrary code via a crafted serialized Java object delivered to the cluster channel and deserialized in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are recommended to upgrade to version 2.0.1, which fixes this issue by removing the clustering feature entirely.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-28
Last updated: 2026-07-29
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-66713

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-667131.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-66713	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Apache Axis2: Vulnerability allows code executioncert-bund

Recent advisories for Deserialization of Untrusted

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-12118: IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attack…nvd · 2026-07-30
highCVE-2026-1360: The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all v…nvd · 2026-07-30
highCVE-2026-14974: IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to exe…nvd · 2026-07-28
criticalCVE-2026-11756: A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIEN…nvd · 2026-07-28
highCVE-2026-15962: The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in…nvd · 2026-07-26
criticalCVE-2026-50517: Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute cod…nvd · 2026-07-24