Unsafe deserialization in Apache Axis2/Java Tribes clustering component (CVE-2026-66713)

A deserialization of untrusted data vulnerability (CWE-502) exists in the Tribes-based clustering component of Apache Axis2/Java when deployed on Apache Tomcat with Tribes clustering enabled. An unauthenticated remote attacker with network access to the clustering port can achieve arbitrary code execution by delivering a crafted serialized Java object to the cluster channel, which is deserialized in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. The vulnerable condition requires Tribes clustering to be explicitly enabled, as it is disabled by default. Affected versions: - Apache Axis2/Java through 2.0.0 We recommend updating to: 2.0.1. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/290 Details: https://vuln.today/cve/CVE-2026-66713