Most recent entries from all

bdu:2026-04928

BIT-activemq-2026-34197 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Affected: Bitnami: activemq

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

certfr-2026-avi-0667 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0667

cnvd-2026-17369

EUVD-2026-354278

fkie_cve-2026-34197

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

GHSA-rxpj-7qvf-xv32 — Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Affected: Maven: org.apache.activemq:activemq-broker, Maven: org.apache.activemq:activemq-all

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.

OESA-2026-2124 — activemq security update

Affected: openEuler:22.03-LTS-SP4: activemq

The most popular and powerful open source messaging and Integration Patterns server. Security Fix(es):

['Severity: low \n\nAffected versions:\n\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\n\nDescription:\n\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \nBroker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \nprovided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the \napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache Activ…

UBUNTU-CVE-2026-34197

Affected: Ubuntu:Pro:16.04:LTS: activemq, Ubuntu:Pro:18.04:LTS: activemq, Ubuntu:Pro:20.04:LTS: activemq, Ubuntu:Pro:22.04:LTS: activemq, Ubuntu:24.04:LTS: activemq, Ubuntu:25.10: activemq, Ubuntu:26.04:LTS: activemq

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

WID-SEC-W-2026-0991 — Apache ActiveMQ, Client, Broker und Web: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um Dateien zu manipulieren oder beliebigen Code auszuführen.