High [CVE-2026-66713] Remote code execution via deserialization of untrusted data in Tribes clustering
This high-severity Red Hat Linux advisory covers CVE-2026-66713.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Remote code execution via deserialization of untrusted data in Tribes clustering. Red Hat rates this important (CVSS 8.1).
Weakness: CWE-502.
- 2.0.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- No currently supported Red Hat product ships the affected Apache Axis2 Tribes clustering module, org.apache.axis2:axis2-clustering, so no mitigation action is required for Red Hat products. For any independently deployed or third party installation of Apache Axis2 through version 2.0.0 with Tribes clustering enabled, disabling the Tribes clustering feature, or restricting network access to the clustering port to trusted hosts only, removes the attack vector. This issue was corrected upstream in Apache Axis2 by removing the clustering feature entirely, so standalone Apache Axis2 deployments should upgrade to a corrected version.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.