Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 CVE-2026-39920 — CVSS 9.8/10 ██████████ BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/cDi2wGDefh
Post summary
CVE‑2026‑39920 is a critical flaw in BridgeHead FileStore versions before 24A that exposes the Apache Axis2 administration module; a patch has already been released.
CVE-2026-39920 BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credent… https://www.cve.org/CVERecord?id=CVE-2026-39920
Post summary
The notice reports that BridgeHead FileStore versions pre‑24A expose the Apache Axis2 admin module over the network with default credentials, marking a vulnerability discovery without any mention of exploitation or patches.