Cyber ·
CVE-2026-120761: XXE in Apache Axis2/Java via imported WSDL/XSD documents
Advisory for an XXE injection in Apache Axis2/Java before version 2.0.2, published on the oss-sec feed on 6 November 2026 with severity rated important. The description received is incomplete.
Advisory CVE-2026-120761 describes an improper restriction of XML external entity reference in Apache Axis2/Java. Versions before 2.0.2 are affected. According to the text received, when a client creates an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, import resolution in wsdl4j was enabled. Documents referenced by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser. The received description is cut off at that point, so the full mechanism, exact impact and any mitigations cannot be confirmed from this copy. To verify, consult the original record in the November 2026 oss-sec archive by searching the CVE identifier, and the official Apache Axis2 project page. Teams consuming SOAP services with Axis2-based client code should check the version in use and plan an upgrade to 2.0.2 or later.