CVE-2026-66713

A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, with network access to the clustering port, to send a specially crafted message. Successful exploitation could lead to the execution of arbitrary code, giving the attacker full control over the affected system.

This flaw affects the Tribes based clustering feature of Apache Axis2/Java, which is disabled by default and only reachable when an administrator has explicitly enabled Tribes clustering and exposed the clustering port to untrusted networks. Exploitation requires the vulnerable org.apache.axis2:axis2-clustering module, containing org.apache.axis2.clustering.tribes.Axis2ChannelListener, to be present on the classpath. Red Hat has reviewed its supported product portfolio and confirmed that no currently shipping Red Hat product includes the Axis2 Tribes clustering module. Some Red Hat products bundle other, unrelated Apache Axis2 components, for example JAX-WS and kernel support jars, but these do not include the vulnerable clustering listener and are therefore not affected by this issue. Apache Tomcat itself, which some Red Hat products ship, is also not affected, as the vulnerable deserialization code resides entirely within Apache Axis2, not within Tomcat.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.