CVE Intelligence
Analysis AI-assisted

CVE-2026-39920: BridgeHead FileStore: Default Credentials in Apache Axis2 Admin Enable Remote Command Execution

CVE-2026-39920 affects BridgeHead FileStore versions prior to 24A, where the Apache Axis2 administration module is reachable over the network with default credentials. According to the record, unauthenticated remote attackers could execute arbitrary operating system commands. The CVSS 3.1 base score is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes BridgeHead FileStore versions prior to 24A, released in early 2024, in which the Apache Axis2 administration module is exposed on network-accessible endpoints using default credentials. The weakness is mapped to CWE-1188, Insecure Default Initialization of Resource.

Impact

  • According to the description, unauthenticated remote attackers could execute arbitrary operating system commands on the affected host.
  • The CVSS 3.1 vector indicates a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • VulnCheck, the CNA, also provides a CVSS 4.0 base score of 9.3.

Affected products and versions

  • Product: BridgeHead FileStore, versions prior to 24A, as stated in the description.
  • The structured affected-products field in the record is empty, so the complete list of affected builds is unknown beyond this range.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed active exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.01051 and a percentile of 0.63393.

Remediation and mitigation

  • Plan an upgrade to BridgeHead FileStore 24A or later, and check the vendor product updates page for the exact fixed build.
  • Until the product is updated, remove or change the default credentials and restrict network access to the administration console and Axis2 endpoints.
  • If the Axis2 administration module is not needed, disable or remove it.
  • Review whether any unexpected web services have been deployed to the Axis2 instance.

Detection guidance

  • Review authentication logs for administrative console logins from unexpected sources or at unusual times.
  • Inspect the Axis2 service deployment locations for services that were not authorized by administrators.
  • Monitor the FileStore host for unexpected child processes started by the application service account.

Limitations of the available information

  • The structured affected and fixed version fields are empty, so the vendor pages and the Apache references must be checked for precise build data.
  • The CVSS scores come from the VulnCheck CNA record; primary NVD scoring details are not included in the record.
  • The content of the referenced pages is not reproduced in the record, so details beyond the description are unknown.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the current source.

Frequently asked questions

What does CVE-2026-39920 affect?

According to the record, it affects BridgeHead FileStore versions prior to 24A, where the Apache Axis2 administration module is exposed with default credentials.

Is this CVE being actively exploited?

The CISA KEV catalog does not list it in the record, and no confirmed active exploitation appears in the sources consulted.

What should administrators do now?

Plan an upgrade to 24A or later, change or remove default credentials, restrict network access to the admin console, and disable the Axis2 admin module if it is not needed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.