Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-39920
PUBLISHED
More InfoOfficial Page
Assigner-VulnCheck
Assigner Org ID-83251b91-4cc7-4094-a5c7-464a1b83ea10
View Known Exploited Vulnerability (KEV) details
Published At-24 Apr, 2026 | 15:48
Updated At-24 Apr, 2026 | 18:17
Rejected At-
▼CVE Numbering Authority (CNA)
BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

Affected Products
Vendor
BridgeHead Software
Product
FileStore
Default Status
unaffected
Versions
Affected
  • From 0 before 24A (custom)
Problem Types
TypeCWE IDDescription
CWECWE-1188CWE-1188 Initialization of a Resource with an Insecure Default
CWECWE-1391CWE-1391 Use of Weak Credentials
Type: CWE
CWE ID: CWE-1188
Description: CWE-1188 Initialization of a Resource with an Insecure Default
Type: CWE
CWE ID: CWE-1391
Description: CWE-1391 Use of Weak Credentials
Metrics
VersionBase scoreBase severityVector
4.09.3CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 4.0
Base score: 9.3
Base severity: CRITICAL
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp.
coordinator
VulnCheck
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba
technical-description
exploit
https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/
release-notes
https://issues.apache.org/jira/browse/AXIS2-4279
related
https://axis.apache.org/axis2/java/core/docs/webadminguide.html
related
https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce
third-party-advisory
Hyperlink: https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba
Resource:
technical-description
exploit
Hyperlink: https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/
Resource:
release-notes
Hyperlink: https://issues.apache.org/jira/browse/AXIS2-4279
Resource:
related
Hyperlink: https://axis.apache.org/axis2/java/core/docs/webadminguide.html
Resource:
related
Hyperlink: https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce
Resource:
third-party-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found