Vulnerability-Lookup

CVE-2026-49157 (GCVE-0-2026-49157)

Vulnerability from cvelistv5 – Published: 2026-06-01 07:20 – Updated: 2026-06-01 14:42

Title

Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default

Summary

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-276 - Incorrect Default Permissions

Assigner

apache

References

2 references

URL	Tags
https://lists.apache.org/thread/rrcsf6s90hj4tdh89…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache ActiveMQ	Affected: 0 , < 5.19.7 (semver) Affected: 6.0.0 , < 6.2.6 (semver)

Credits

Leon Johnson (github: lokerxx)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-01T07:48:06.780Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/31/21"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-49157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T14:42:18.312516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T14:42:33.386Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leon Johnson (github: lokerxx)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Default Permissions vulnerability in Apache ActiveMQ.\u003c/p\u003e\u003cp\u003eThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\u003c/p\u003e\u003cp\u003eThe default Jolokia authorization settings granted\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003enon-admin (low-privilege) web-login accounts\u003c/span\u003e\u0026nbsp;access to Jolokia operations which allowed executing broker management operations meant for admins such as \u003ccode\u003eaddQueue\u003c/code\u003e and \u003ccode\u003eremoveQueue\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Default Permissions vulnerability in Apache ActiveMQ.\n\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nThe default Jolokia authorization settings granted\u00a0non-admin (low-privilege) web-login accounts\u00a0access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.\n\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T07:20:10.862Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-49157",
    "datePublished": "2026-06-01T07:20:10.862Z",
    "dateReserved": "2026-05-27T21:28:11.005Z",
    "dateUpdated": "2026-06-01T14:42:33.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49157",
      "date": "2026-06-02",
      "epss": "0.0007",
      "percentile": "0.21537"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49157\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-06-01T09:16:20.427\",\"lastModified\":\"2026-06-01T17:09:59.100\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Incorrect Default Permissions vulnerability in Apache ActiveMQ.\\n\\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\\n\\nThe default Jolokia authorization settings granted\u00a0non-admin (low-privilege) web-login accounts\u00a0access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.\\n\\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.19.7\",\"matchCriteriaId\":\"793E68E6-9024-4518-B062-42B2DE5BB555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.2.6\",\"matchCriteriaId\":\"FFF44DB9-1850-4B5F-AD0F-55CB5219AB22\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/31/21\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/31/21\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-06-01T07:48:06.780Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-49157\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-01T14:42:18.312516Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-01T14:42:08.518Z\"}}], \"cna\": {\"title\": \"Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Leon Johnson (github: lokerxx)\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache ActiveMQ\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.19.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.2.6\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.activemq:apache-activemq\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Incorrect Default Permissions vulnerability in Apache ActiveMQ.\\n\\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\\n\\nThe default Jolokia authorization settings granted\\u00a0non-admin (low-privilege) web-login accounts\\u00a0access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.\\n\\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIncorrect Default Permissions vulnerability in Apache ActiveMQ.\u003c/p\u003e\u003cp\u003eThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\u003c/p\u003e\u003cp\u003eThe default Jolokia authorization settings granted\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003enon-admin (low-privilege) web-login accounts\u003c/span\u003e\u0026nbsp;access to Jolokia operations which allowed executing broker management operations meant for admins such as \u003ccode\u003eaddQueue\u003c/code\u003e and \u003ccode\u003eremoveQueue\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276 Incorrect Default Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-06-01T07:20:10.862Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-49157\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T14:42:33.386Z\", \"dateReserved\": \"2026-05-27T21:28:11.005Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-06-01T07:20:10.862Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49157

Vulnerability from fkie_nvd - Published: 2026-06-01 09:16 - Updated: 2026-06-01 17:09

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8	Mailing List, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/05/31/21	Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	apache	activemq	*
	apache	activemq	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
              "versionEndExcluding": "5.19.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Default Permissions vulnerability in Apache ActiveMQ.\n\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nThe default Jolokia authorization settings granted\u00a0non-admin (low-privilege) web-login accounts\u00a0access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.\n\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue."
    }
  ],
  "id": "CVE-2026-49157",
  "lastModified": "2026-06-01T17:09:59.100",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-01T09:16:20.427",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/21"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-99QX-5QQR-4J95

Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-06-01 15:30

Details

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-49157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T09:16:20Z",
    "severity": "HIGH"
  },
  "details": "Incorrect Default Permissions vulnerability in Apache ActiveMQ.\n\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nThe default Jolokia authorization settings granted\u00a0non-admin (low-privilege) web-login accounts\u00a0access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.\n\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.",
  "id": "GHSA-99qx-5qqr-4j95",
  "modified": "2026-06-01T15:30:40Z",
  "published": "2026-06-01T09:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49157"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1741

Vulnerability from csaf_certbund - Published: 2026-05-31 22:00 - Updated: 2026-06-01 22:00

Summary

Apache ActiveMQ: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuführen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-42253

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-42588

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-45505

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-46605

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-49157

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-49270

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

References

9 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.data	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1741 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1741.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1741 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1741"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-42253-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-42588-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-46605-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-49270-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache ActiveMQ: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-01T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-02T05:12:27.283+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1741",
      "initial_release_date": "2026-05-31T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-31T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-01T22:00:00.000+00:00",
          "number": "2",
          "summary": "Link zu CVE-2026-46605 korrigiert"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.19.7",
                "product": {
                  "name": "Apache ActiveMQ \u003c5.19.7",
                  "product_id": "T054887"
                }
              },
              {
                "category": "product_version",
                "name": "5.19.7",
                "product": {
                  "name": "Apache ActiveMQ 5.19.7",
                  "product_id": "T054887-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:activemq:5.19.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.2.6",
                "product": {
                  "name": "Apache ActiveMQ \u003c6.2.6",
                  "product_id": "T054888"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.6",
                "product": {
                  "name": "Apache ActiveMQ 6.2.6",
                  "product_id": "T054888-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:activemq:6.2.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveMQ"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42253",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-42253"
    },
    {
      "cve": "CVE-2026-42588",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-42588"
    },
    {
      "cve": "CVE-2026-45505",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-45505"
    },
    {
      "cve": "CVE-2026-46605",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-46605"
    },
    {
      "cve": "CVE-2026-49157",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-49157"
    },
    {
      "cve": "CVE-2026-49270",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-49270"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-49157 (GCVE-0-2026-49157)

FKIE_CVE-2026-49157

GHSA-99QX-5QQR-4J95

WID-SEC-W-2026-1741

Tags

Sightings

Nomenclature