CVE-2021-26117: Apache ActiveMQ

High severity, CVSS 7.5. EPSS: 11.3% chance of exploitation in the next 30 days.

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

Affected products

• Apache ActiveMQ: from 5.15.0, before 5.15.14 (fixed in 5.15.14); from 5.16.0, before 5.16.1 (fixed in 5.16.1)
• Apache Artemis: before 2.16.0 (fixed in 2.16.0)
• Debian Debian Linux: version 9.0 only
• Netapp Oncommand Workflow Automation: affected versions not specified
• Oracle Communications Element Manager: from 8.2.0, up to and including 8.2.4.0
• Oracle Communications Session Report Manager: from 8.2.0, up to and including 8.2.2
• Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.2
• Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only

Published 2021-01-27. Last modified 2026-06-17.