CVE-2026-123753
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or…
- CVSS
- 9.1 Critical
- EPSS
- 0.2%
- Percentile
- 12
- Published
- 2026-11-09
- Force
- 5 of 12
- Public PoC
- 1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N