CVE-2026-123766

EUVD-2026-119935

09.11.2026, 11:17

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Cross-site Scripting

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	UNKNOWN				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
apache	axis2/java	2.0.1 ≤ 𝑥 < 2.0.2	CNA

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Vulnerability Media Exposure

[GERMAN] Apache Axis2: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apache Axis2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, oder einen Denial of Service Angriff durchzuführen.
Published: 2026-11-08T23:00:00+00:00

References

https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html

https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117

https://lists.apache.org/thread.html/gzxdd4gobm1kb0jdonmn4n8xhjkwlrbg

http://www.openwall.com/lists/oss-security/2026/11/06/24