CVE-2026-42588
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Apache ActiveMQ before versions 5.19.7 and 6.2.6 has a code injection vulnerability via the Jolokia JMX-HTTP bridge. An authenticated attacker can invoke BrokerService.addNetworkConnector with a crafted URI that loads a Spring XML context, leading to remote code execution on the broker's JVM.
Risk Assessment
An authenticated attacker can gain full control over the ActiveMQ broker by executing arbitrary code on the server.
Recommendation
Update Apache ActiveMQ to version 5.19.7 or 6.2.6. Restrict access to the web console and Jolokia bridge.
Other vulnerabilities in Apache ActiveMQ
See all- CVE-2014-3576High
The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before version 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
- CVE-2026-40466High
A vulnerability in Apache ActiveMQ allows an authenticated attacker to bypass the fix for CVE-2026-34197 by adding a connector using HTTP Discovery transport. The attacker can use a malicious HTTP endpoint returning a VM transport, leading to loading a remote Spring XML application context and arbitrary code execution on the broker's JVM.
- CVE-2026-34197HighActively exploited
A vulnerability in Apache ActiveMQ allows an authenticated attacker to achieve remote code execution on the broker via the Jolokia JMX-HTTP endpoint. The attack invokes network connector operations with a crafted URI that loads a remote Spring XML context, leading to arbitrary code execution in the broker's JVM.
- CVE-2015-5254Critical
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, allowing remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
- CVE-2026-61487Medium
Improper authorization in Apache ActiveMQ allows an authenticated low-privilege user to bypass per-destination write ACLs by sending to a temporary composite destination, bypassing the authorization check.
- CVE-2026-59878High
Apache ActiveMQ (versions before 5.19.9 and 6.0.0 before 6.2.8) has a vulnerability in the AMQP NIO component. A remote unauthenticated attacker can send a frame with a specific size, causing NIO threads to die. Rapid repetition can exhaust the NIO thread pool, leading to denial of service.
- CVE-2026-54475High
A missing authorization vulnerability was found in Apache ActiveMQ for temporary destinations. Temporary destinations are expected to be isolated to the connection that created them, but the isolation is only checked on the client side, allowing a different connection to consume from another connection's temporary destination.
- CVE-2026-53917High
A vulnerability in Apache ActiveMQ allows an authenticated user to cause a DoS attack on the broker by sending a crafted OpenWire message with an excessive map size value. The lack of size validation during deserialization of message property maps can trigger OOM and crash the broker.
- CVE-2026-53916High
A vulnerability in Apache ActiveMQ allows an unauthenticated client to send non-terminating header bytes via STOMP NIO, causing unlimited buffering and JVM heap exhaustion.
- CVE-2026-52760Medium
A Cross-site Scripting (XSS) vulnerability was found in Apache ActiveMQ and its Web Console. The browse page renders a message ID without sanitization, allowing an authenticated producer to send a crafted JMS message ID containing HTML/JavaScript. When an administrator browses the queue, the payload executes in their browser.
Original NVD description (English source)
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.