Apache ActiveMQ All vulnerabilities

3 CVEs affecting Apache ActiveMQ All, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-74761, published 2026-09-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-59878, published 2026-07-28. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger…
CVE-2026-74761, published 2026-09-09. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable…
CVE-2026-61487, published 2026-07-28. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an…