BridgeHead FileStore CVE-2026-39920

Apache Axis2 administration module must be network-accessible on the FileStore installation (default deployment configuration for pre-24A versions). Default administrative credentials for Axis2 must remain unchanged from product installation (vendor-confirmed default state). No authentication to BridgeHead FileStore itself is required - the exposed Axis2 interface has independent default credentials. Network path from attacker to the Axis2 admin endpoint must exist, but perimeter firewalls often allow access to application ports if FileStore is intended for network file storage access. No special FileStore features or non-default configurations required - this affects standard installations. The vulnerability impacts default out-of-box deployments, making it exploitable against any organization that installed FileStore pre-24A without hardening the embedded Axis2 component.

This represents critical real-world risk requiring immediate prioritization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the worst-case scenario: network-accessible, low complexity, no authentication, no user interaction required. Publicly available exploit code (GitHub Gist from VAMorales) lowers the skill barrier for exploitation to script-kiddie level. The attack chain is straightforward: login with defaults → upload malicious AAR → execute SOAP request → full OS command execution. While EPSS score is not provided, the combination of public exploit availability, default credential abuse, and healthcare sector targeting (FileStore is medical data storage infrastructure) suggests high exploitation likelihood. SSVC technical impact is total (arbitrary code execution), and the attack is fully automatable once targets are identified via network scanning. No CISA KEV listing yet, but this may reflect the CVE's recent assignment rather than absence of exploitation. Defending organizations must assume breach if running pre-24A versions with exposed Axis2 endpoints. The Apache Axis2 JIRA reference (AXIS2-4279) indicates this is a known issue in the upstream component dating back years, suggesting vendor responsibility for secure integration rather than Apache framework flaw alone.

Attacker performs network reconnaissance to identify BridgeHead FileStore instances exposing Apache Axis2 endpoints (typically port 8080 or 8443 with /axis2/ path). Using publicly available exploit code from GitHub (https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba), attacker authenticates to the Axis2 admin console with default credentials. Attacker then uploads a weaponized Java AAR file containing reverse shell payload disguised as a legitimate web service. By sending crafted SOAP requests to the newly deployed service, attacker executes arbitrary OS commands with the privileges of the FileStore application user, typically achieving full system control and access to healthcare data repositories.