A critical deserialization vulnerability (CWE-502) exists in the Tribes-based clustering component of Apache Axis2/Java through version 2.0.0 when deployed on Apache Tomcat. The flaw allows an unauthenticated remote attacker with network access to the clustering port to execute arbitrary code by delivering a crafted serialized Java object to the cluster channel. The vulnerable code path is in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. The vulnerability is only exploitable when Tribes clustering is explicitly enabled, which is off by default. Apache has addressed the issue in version 2.0.1 by completely removing the clustering feature. Users are strongly advised to upgrade to version 2.0.1 immediately. The fix is confirmed via a commit to the official Apache Axis2 Java core GitHub repository.