CVE-2026-39920

BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://axis.apache.org/axis2/java/core/docs/webadminguide.html
https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba
https://issues.apache.org/jira/browse/AXIS2-4279
https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/
https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) BridgeHead FileStore versiones anteriores a la 24A (lanzada a principios de 2024) exponen el módulo de administración de Apache Axis2 en puntos finales accesibles por red con credenciales predeterminadas que permite a atacantes remotos no autenticados ejecutar comandos arbitrarios del sistema operativo. Los atacantes pueden autenticarse en la consola de administración utilizando credenciales predeterminadas, cargar un archivo Java malicioso como un servicio web y ejecutar comandos arbitrarios en el host a través de solicitudes SOAP al servicio desplegado.

Information

Published : 2026-04-24 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-39920

Mitre link : CVE-2026-39920

CVE.ORG link : CVE-2026-39920

JSON object : View

Products Affected

No product.

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

CWE-1391

Use of Weak Credentials

{"id": "CVE-2026-39920", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39920", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T17:25:34.553059Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "BridgeHead Software", "product": "FileStore", "versions": [{"status": "affected", "version": "0", "lessThan": "24A", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-24T16:16:36.267", "references": [{"url": "https://axis.apache.org/axis2/java/core/docs/webadminguide.html", "source": "disclosure@vulncheck.com"}, {"url": "https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba", "source": "disclosure@vulncheck.com"}, {"url": "https://issues.apache.org/jira/browse/AXIS2-4279", "source": "disclosure@vulncheck.com"}, {"url": "https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1188"}, {"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service."}, {"lang": "es", "value": "BridgeHead FileStore versiones anteriores a la 24A (lanzada a principios de 2024) exponen el m\u00f3dulo de administraci\u00f3n de Apache Axis2 en puntos finales accesibles por red con credenciales predeterminadas que permite a atacantes remotos no autenticados ejecutar comandos arbitrarios del sistema operativo. Los atacantes pueden autenticarse en la consola de administraci\u00f3n utilizando credenciales predeterminadas, cargar un archivo Java malicioso como un servicio web y ejecutar comandos arbitrarios en el host a trav\u00e9s de solicitudes SOAP al servicio desplegado."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "disclosure@vulncheck.com"}