Vulnerability · Published Apr 24, 2026 · Assigned by VulnCheck

CVE-2026-39920BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

Critical 9.8

In plain English

A critical-severity security flaw in FileStore from BridgeHead Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

Affected products (as reported)

Vendor	Product	Versions
BridgeHead Software	FileStore	0 – before 24A

Weakness: CWE-1188, CWE-1391 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba technical-description, exploit
https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/ release-notes
https://issues.apache.org/jira/browse/AXIS2-4279 related
https://axis.apache.org/axis2/java/core/docs/webadminguide.html related
https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce third-party-advisory