{"metadata": {"vulnerability": "CVE-2026-123779", "count": 18, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-11-06T14:27:45.371Z", "date_only": false, "value": "2026-11-06T14:27:45.371Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-123779", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T19:19:34.839Z", "date_only": false, "value": "2026-11-06T19:19:34.839712Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/crznx7tbtdvsr", "record": "CVE-2026-123779", "field": "creation_timestamp", "uuid": "b56344ef-7524-4f64-8a2d-2b9e8caf0c18", "content": "CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/crznx7tbtdvsr"}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "vulnerabilities.6.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T03:17:24Z", "date_only": false, "value": "2026-11-09T03:17:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-123779", "record": "CVE-2026-123779", "field": "creation_timestamp", "uuid": "7d932f4d-2ad8-4c48-a030-6ca43326a8bd", "url": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-123779"}, {"timestamp": "2026-11-09T10:29:30.229Z", "date_only": false, "value": "2026-11-09T10:29:30.229Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-123779", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T10:29:30.229Z", "date_only": false, "value": "2026-11-09T10:29:30.229Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-123779", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T10:39:46.983Z", "date_only": false, "value": "2026-11-09T10:39:46.983210Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117586053455628353", "record": "CVE-2026-123779", "field": "creation_timestamp", "uuid": "586a0bcd-fb9c-4222-aff8-87822a7d965d", "content": "CVE-2026-123779 Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-123779https://axis.apache.org/axis2/java/core/release-notes/2.0.2.htmlhttps://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23https://lists.apache.org/thread.html/qqn6c4fb8tj0ldmb97c75zzxdjrh5dl3#apache #ApacheSoftwareFoundation #ApacheAxis2/Java#CVE_2026_123779#bot", "url": "https://infosec.exchange/users/cve/statuses/117586053455628353"}, {"timestamp": "2026-11-09T11:09:03.661Z", "date_only": false, "value": "2026-11-09T11:09:03.661Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-123779", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T11:09:03.661Z", "date_only": false, "value": "2026-11-09T11:09:03.661Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-123779", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T11:17:24Z", "date_only": false, "value": "2026-11-09T11:17:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F58R-C62M-574F", "record": "GHSA-F58R-C62M-574F", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T11:17:24.310Z", "date_only": false, "value": "2026-11-09T11:17:24.310", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-123779", "record": "FKIE_CVE-2026-123779", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T11:17:24.310Z", "date_only": false, "value": "2026-11-09T11:17:24.310", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-123779", "record": "FKIE_CVE-2026-123779", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-09T12:31:45Z", "date_only": false, "value": "2026-11-09T12:31:45Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F58R-C62M-574F", "record": "GHSA-F58R-C62M-574F", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:31:45Z", "date_only": false, "value": "2026-11-09T12:31:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F58R-C62M-574F", "record": "GHSA-F58R-C62M-574F", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T12:42:03.735Z", "date_only": false, "value": "2026-11-09T12:42:03.735+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-09T16:20:21.231Z", "anchors": {"origin": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 62421.231729, "hours": 17.339231035833333, "days": 0.7224679598263889, "min_seconds": 62421.231729, "max_seconds": 62421.231729, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4415", "record": "WID-SEC-W-2026-4415", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-09T16:20:21.231Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}