Critical 9.8Published Apr 24, 2026

CVE-2026-39920BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

Updated under an hour ago (Oct 28, 2026, 1:23 AM ET)

Does this affect you?

It affects BridgeHead Software FileStore. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for BridgeHead Software FileStore

Exploited in the last 30 days

BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-1188, CWE-1391
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Apr 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

BridgeHead Software FileStore bridgehead_software:filestore (from the name)	before 24A	CNA record

References

References

https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba	technical-description, exploit
https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/	release-notes
https://issues.apache.org/jira/browse/AXIS2-4279	related
https://axis.apache.org/axis2/java/core/docs/webadminguide.html	related
https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.