CVE-2026-39920

CRITICAL 9.8

BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

CWE	CWE-1188 CWE-1391
Vendor	bridgehead software
Product	filestore
Published	Apr 24, 2026

Stay Ahead of the Next One

Get instant alerts for bridgehead software filestore

Be the first to know when new critical vulnerabilities affecting bridgehead software filestore are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

BridgeHead Software / FileStore

0 < 24A

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gist.github.com: https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba bridgeheadsoftware.com: https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/ issues.apache.org: https://issues.apache.org/jira/browse/AXIS2-4279 axis.apache.org: https://axis.apache.org/axis2/java/core/docs/webadminguide.html vulncheck.com: https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce

Credits

Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp. VulnCheck