Vulnerability Intelligence Report
BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE
CVE-2026-39920
BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
EPSS Probability:0.54%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-1188 ↗CWE-1188 Initialization of a Resource with an Insecure Default
CWE-1391 ↗CWE-1391 Use of Weak Credentials
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| BridgeHead Software | FileStore | 0 < 24A (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.540%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-04-07T20:57:06 |
| Published | 2026-04-24T15:48:26 |
| Last Updated | 2026-04-24T18:17:02 |
Community Chatter & Buzz