CVE-2026-39920 - BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

CVE ID :CVE-2026-39920
Published : April 24, 2026, 3:48 p.m. | 26 minutes ago
Description :BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...