Apache ActiveMQ Broker vulnerabilities

15 CVEs affecting Apache ActiveMQ Broker, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-74761, published 2026-09-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability, published 2026-04-07. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-04-16. EPSS: 15.5% chance of exploitation in the next 30 days. Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP…
CVE-2026-40466, published 2026-04-24. High severity, CVSS 8.8. EPSS: 4.1% chance of exploitation in the next 30 days. Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may…
CVE-2026-41044, published 2026-04-24. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use…
CVE-2026-39304, published 2026-04-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates…
CVE-2026-45505, published 2026-06-01. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery…
CVE-2026-53917, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by…
CVE-2026-50750, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause…
CVE-2026-33227, published 2026-04-07. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two…
CVE-2026-42588, published 2026-06-01. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes…
CVE-2026-49434, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured…

Latest

CVE-2026-74761, published 2026-09-09. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable…
CVE-2026-61487, published 2026-07-28. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an…
CVE-2026-54475, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that…
CVE-2026-49270, published 2026-06-01. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured with a network connector with…
CVE-2026-46605, published 2026-06-01. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects…