Apache ActiveMQ Web vulnerabilities

4 CVEs affecting Apache ActiveMQ Web, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-52760, published 2026-06-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-41043, published 2026-04-24. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when…
CVE-2026-52760, published 2026-06-30. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a…
CVE-2026-42253, published 2026-06-01. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies…
CVE-2026-33227, published 2026-04-07. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two…