CVE-2010-0219: Apache Axis2 default admin password enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityA default administrative credential on a network-reachable service with a CVSS 2.0 score of 10 and public exploit references allows unauthenticated attackers to achieve remote code execution.

What it is

Apache Axis2, as bundled in products such as SAP BusinessObjects Enterprise XI 3.2 and CA ARCserve D2D r15, ships with a default password of 'axis2' for its admin account. An attacker who reaches the admin interface can authenticate with these known credentials and upload a crafted web service, turning a configuration weakness into remote code execution.

Impact

An attacker gains administrative control of the Axis2 service and can execute arbitrary code on the host by deploying a malicious web service. This typically yields full compromise of the application server and any data or credentials it can reach.

Attack surface

The flaw is reachable over the network through the exposed Axis2 administrative interface (AV:N/AC:L/Au:N), so no prior authentication is required because the default credentials are the authentication. No user interaction is described in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.90851, 99.8th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply the vendor patch referenced in the SAP support note (service.sap.com/sap/support/notes/1432881) and any Axis2 updates for affected products.
• Immediately change the default 'axis2' admin password on every exposed Axis2 instance and remove or disable the admin application where it is not needed.
• Restrict network access to the Axis2 admin interface to trusted management hosts only.
• Audit bundled Axis2 deployments in SAP BusinessObjects and CA ARCserve D2D for the same default credential.
• Monitor for unauthorized web service deployments and treat any unexpected .aar upload as a compromise indicator.

Detection

• Search web and application logs for authentication to the Axis2 admin console using the account 'axis2' or the password 'axis2'.
• Alert on uploads of .aar files or new web service deployments outside change windows.
• Baseline and monitor outbound connections from the Axis2 host for signs of post-exploitation activity.
• Inventory internet- or network-exposed Axis2 admin endpoints and verify the default password has been changed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.