CSIRT Italia, the unit of Italy's National Cybersecurity Agency, has detected active exploitation in the wild of CVE-2026-90436 in Apache Axis 1.x. The flaw allows a remote attacker to execute code on affected systems and carries a score of 9.8. A PoC, meaning a proof-of-concept code, is already available. The tricky part is that the product has reached end of life and the vendor will not release updates.
A few terms before we get into the facts. Apache Axis is an open source framework for building SOAP-based web services. SOAP is a protocol for exchanging structured messages between applications. Deserialization is the step that rebuilds an object from the data received. RCE stands for Remote Code Execution, running code from a remote location. EoL indicates end of life, after which no more fixes are released.
What did the ACN report Apache Axis?
In the alert AL02/261113/CSIRT-ITA , published on 13 November 2026, CSIRT Italia reports active exploitation of CVE-2026-90436. A Proof of Concept also exists, which lowers the bar for anyone wanting to try the attack.
The type is Remote Code Execution and the CVSS 3.1 score is 9.8. For the ACN the flaw could allow a remote malicious user to run arbitrary code.
How does the flaw in SOAP deserialization work?
According to the ACN the problem stems from unsafe deserialization of incoming SOAP error messages. The system loads and instantiates arbitrary classes specified by the user before checking their validity.
An unauthenticated attacker could therefore send specially crafted SOAP requests. Code execution does, however, require suitable classes for the abuse to be present, as the alert specifies. No prior access is needed.
Which versions are affected?
The alert indicates Apache Axis 1.x, all versions. There is therefore no release to avoid and one that is safe, the entire branch is affected.
The ACN note is clear. The vendor will not release any update because the product has reached its end-of-support date. This differs from cases where simply installing the latest version is enough, as in the case of Apache HTTP Server and mod_http2 .
What can be done if no update exists?
The ACN recommendation, in line with the vendor, is to plan a migration to an alternative product that is still supported, such as Apache Axis 2.
If migration is not possible right away, the vendor has made a corrective patch available to apply manually, following the security bulletin listed among the alert's references. It is a stopgap solution, not a return to support.
The alert does not say who is exploiting the flaw, how many systems have been hit, or which classes are needed for the abuse. We also do not know how many Italian services still use Axis 1.x. The name of the bulletin with the manual patch is not given in the text we have. The picture could change if new exploit chains emerge.
What changes for those working with digital systems
If you run applications that expose SOAP services, check whether Axis 1.x sits behind them. The component often lives inside old software that nobody has touched in years, so review your inventories and dependencies. Anyone managing servers for clients should treat this as urgent, including for managed hosting and servers where inherited code runs. A flaw with no official fix forces a choice between a manual patch and a rewrite. The same reasoning applies to custom software, and the experience with Apache OFBiz shows how much maintenance matters.
This case shows the hidden cost of forgotten dependencies. A framework past end of support keeps working, and for that very reason it stays where it is until someone attacks it. The combination of a public PoC, no need for authentication, and no official update is the worst possible. A manual patch is fine as a bridge, but treating it as a permanent solution only moves the problem. It is wise to include end-of-support status among your risk criteria, alongside CVSS scores.
Frequently asked questions
Is CVE-2026-90436 already being exploited?
Yes, according to CSIRT Italia active exploitation in the wild has been detected. A Proof of Concept also exists.
Which versions of Apache Axis are vulnerable?
All versions of Apache Axis 1.x. The vendor will not release updates because the product has reached end of support.
Does exploiting the flaw require authentication?
No, the ACN describes a remote, unauthenticated attacker. Specially crafted SOAP requests are enough, provided suitable classes are present for the abuse.
What does the ACN recommend?
Plan a migration to a supported product, such as Apache Axis 2. Alternatively, you can manually apply the vendor patch described in the bulletin.
How serious is the vulnerability?
The CVSS 3.1 score is 9.8, close to the maximum. The type is Remote Code Execution.
Axis 1.x, what to check in the coming weeks
The vulnerability is already being used and no official fix is coming. What matters is how quickly you close the exposure.
Follow CSIRT Italia's updates on the alert, in case of revisions or new details.
Set a deadline for migration and assign an owner, including for little-used services.
Keep a list of end-of-support components across your projects, as you do for expiring certificates.
acn.gov.it, Apache Axis – rilevato sfruttamento in rete della CVE-2026-90436
Apple tvOS 27.2.1 brings Siri AI to second and third generation Apple TV 4K
Apple releases tvOS 27.2.1 and brings Siri AI to second and third generation Apple TV 4K. Requirements, supported langua...
Windows, SignDrop exploits Microsoft's CLFS mitigation to gain SYSTEM rights
SignDrop is a public exploit that turns Windows' CLFS mitigation into SYSTEM privilege escalation. What we know, what we...
Claude by Anthropic goes down on November 13, errors hit the app, API and Claude Code
On November 13 Claude suffered high error rates on claude.ai, Claude Code and the API, during the Microsoft blackout. Wh...
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
