# axis:axis (Maven) vulnerabilities

7 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.4 (Apr 23, 2006): affected by 6 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Dependents: 384
- Releases: 13 since 1.0 (Nov 22, 2005)
- Registry: https://central.sonatype.com/artifact/axis/axis
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-90436: 1.0 to 1.4 (through the newest release)
- CVE-2023-51441: 1.0 to 1.3 (1.4 is outside it)
- CVE-2023-40743: 1.0 to 1.4 (through the newest release)
- CVE-2019-0227: 1.0 to 1.4 (through the newest release)
- CVE-2018-8032: 1.0 to 1.4 (through the newest release)
- CVE-2014-3596: 1.0 to 1.4 (through the newest release)
- CVE-2012-5784: 1.0 to 1.4 (through the newest release)

## Advisories (7)

### [CVE-2026-90436](https://cve.now/CVE-2026-90436): Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

- Severity: Critical
- Published: Nov 6, 2026
- Affected: through 1.4.
- No fix released. The latest release, 1.4, is still affected.

### [CVE-2023-51441](https://cve.now/CVE-2023-51441): Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API

- Severity: High 7.2
- Published: Jan 6, 2024
- Affected: through 1.3.
- Fixed in 1.4 (released Apr 23, 2006, 6467 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 1.4, is not affected.

### [CVE-2023-40743](https://cve.now/CVE-2023-40743): Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

- Severity: Critical 9.8
- Published: Sep 5, 2023
- Affected: through 1.4.
- No fix released. The latest release, 1.4, is still affected.

### [CVE-2019-0227](https://cve.now/CVE-2019-0227): A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.

- Severity: Unrated
- Published: May 1, 2019
- Affected: through 1.4.
- No fix released. The latest release, 1.4, is still affected.

### [CVE-2018-8032](https://cve.now/CVE-2018-8032): Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

- Severity: Unrated
- Published: Aug 2, 2018
- Affected: through 1.4.
- No fix released. The latest release, 1.4, is still affected.

### [CVE-2014-3596](https://cve.now/CVE-2014-3596): The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's…

- Severity: Unrated
- Published: Aug 27, 2014
- Affected: through 1.4.
- No fix released. The latest release, 1.4, is still affected.

### [CVE-2012-5784](https://cve.now/CVE-2012-5784): Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message…

- Severity: Unrated
- Published: Nov 4, 2012
- Affected: through 1.4.
- No fix released. The latest release, 1.4, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/axis:axis
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.