CVE-2026-24457
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Unsafe parsing of OpenMQ's configuration in versions <6.5.2 and <6.9.0 allows a remote attacker to read arbitrary files from an MQ Broker's server. Full exploitation could read unauthorized files of the OpenMQ's host OS. In some scenarios RCE could be achieved.
Risk Assessment
An attacker could access sensitive system data and potentially take control of the server, posing a serious threat to system integrity and confidentiality.
Recommendation
Immediately upgrade OpenMQ to version 6.5.2 or 6.9.0, and GlassFish to 7.0.26, 7.1.1, or 8.0.2 to remediate the vulnerability.
Original NVD description (English source)
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.