Which versions of BridgeHead FileStore are affected by CVE-2026-39920?

BridgeHead FileStore versions prior to 24A contain a critical remote code execution vulnerability (CVSS 9.8) in Apache Axis2 that allows unauthenticated attackers to execute arbitrary operating…. A patch is available.

Is there a public PoC exploit available for CVE-2026-39920?

Yes, a public proof-of-concept exploit is available for CVE-2026-39920. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-39920?

Within 24 hours: Identify all BridgeHead FileStore instances running versions before 24A; isolate affected systems from production networks or restrict network access to the Axis2 admin console (default port 8080) at network perimeter. Within 7 days: Upgrade all BridgeHead FileStore deployments to version 24A or later; reset all Axis2 default credentials immediately upon deployment. Within 30 days: Conduct forensic review of access logs and system activity on previously vulnerable instances to detect indicators of compromise; implement network segmentation and access controls to restrict admin console access to authorized administrative networks only.

BridgeHead FileStore CVE-2026-39920

Q: What is the CVSS score of CVE-2026-39920?

CVE-2026-39920 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25569 CRITICAL

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-04-24 VulnCheck

Apache Java Information Disclosure Filestore

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 24, 2026 - 17:55 vuln.today

Public exploit code

Patch released

Apr 24, 2026 - 17:55 nvd

Patch available

Apr 24, 2026 - 17:01 EUVD

Re-analysis Queued

Apr 24, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Apr 24, 2026 - 16:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Apr 24, 2026 - 16:15 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 16:00 euvd

EUVD-2026-25569

Analysis Generated

Apr 24, 2026 - 16:00 vuln.today

CVE Published

Apr 24, 2026 - 15:48 nvd

CRITICAL 9.3

DescriptionCVE.org

BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

AnalysisAI

Remote code execution in BridgeHead FileStore pre-24A via Apache Axis2 default credentials allows unauthenticated attackers to deploy malicious web services and execute arbitrary OS commands. The vulnerability exploits exposed Axis2 admin console with unchanged default credentials, enabling full system compromise over the network with no authentication required. Publicly available exploit code exists (GitHub Gist), and CVSS 9.8 reflects critical risk with network vector, low complexity, and no privileges required. EPSS data not provided but exploitation prerequisites are minimal given default credential exposure.

Technical ContextAI

BridgeHead FileStore embeds Apache Axis2, a SOAP-based web services framework for Java. The product exposes the Axis2 administration module on network-accessible endpoints without requiring organizations to change default credentials during deployment. Apache Axis2's admin interface allows authenticated users to deploy arbitrary Java web services as AAR (Axis Archive) files. This vulnerability exploits CWE-1188 (Insecure Default Initialization of Resource), where the product ships with hardcoded credentials that remain active in production environments. Attackers leverage this to upload malicious Java archives containing command execution payloads, then invoke those services via SOAP requests to achieve remote code execution. The affected CPE (cpe:2.3:a:bridgehead_software:filestore) indicates BridgeHead Software's FileStore product line, with all versions prior to 24A vulnerable.

RemediationAI

Upgrade to BridgeHead FileStore version 24A or later, which removes or properly secures the exposed Apache Axis2 administration interface per vendor advisory at https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/. For organizations unable to immediately upgrade, implement network-level controls to restrict access to Axis2 admin endpoints (typically /axis2/axis2-admin/ or similar paths) to only authorized administrative networks or localhost - this significantly raises attacker cost but does not eliminate risk if internal threats or pivoting scenarios exist. Change default Axis2 admin credentials immediately per Apache documentation at https://axis.apache.org/axis2/java/core/docs/webadminguide.html, though this workaround is fragile as credentials may reset during product updates. Disable or uninstall the Axis2 admin module entirely if not required for FileStore operation, but verify with BridgeHead support that this does not break core functionality. Monitor for unauthorized SOAP service deployments and outbound connections from FileStore servers as indicators of compromise. All workarounds carry operational risk and version 24A upgrade is the only confirmed complete remediation.