CVE-2026-42588

🗓️ 01 Jun 2026 07:23:17Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 193 Views🌐 WEB

Authenticated attacker can trigger remote code execution in ActiveMQ via Jolokia by crafting a discovery URI.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in activemq-all jar	27 Jul 202607:41	–	ibm
GithubExploit	Exploit for Improper Input Validation in Apache Activemq	4 Jul 202606:45	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Apache Activemq	6 Jun 202605:47	–	githubexploit
ATTACKERKB	CVE-2026-42588	1 Jun 202607:23	–	attackerkb
Information Security Automation	June Linux Patch Wednesday	26 Jun 202617:00	–	avleonov
Atlassian	RCE (Remote Code Execution) at Apache ActiveMQ dependency in Bamboo Data Center	11 Jul 202604:29	–	atlassian
BDU FSTEC	The vulnerability of the Jolokia web console component in Apache ActiveMQ allows a hacker to execute arbitrary code.	19 Jun 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42588 vulnerabilities	10 Jul 202620:20	–	cgr
Circl	CVE-2026-42588	31 May 202617:43	–	circl
CNNVD	Apache ActiveMQ 安全漏洞	1 Jun 202600:00	–	cnnvd

NVD

Vulners

Node

apache activemqRange<5.19.7

apache activemqRange6.0.0–6.2.6

apache activemq_brokerRange<5.19.7

apache activemq_brokerRange6.0.0–6.2.6

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:activemq-broker",
    "product": "Apache ActiveMQ Broker",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.19.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "6.2.6",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:activemq-all",
    "product": "Apache ActiveMQ All",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.19.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "6.2.6",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:apache-activemq",
    "product": "Apache ActiveMQ",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.19.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "6.2.6",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/ns0zktfo16s9ql2mmtqtlb6p6xcs45xm
openwall	www.openwall.com/lists/oss-security/2026/05/31/18

Parameter	Position	Path	Description	CWE
brokerConfig	request body	/api/jolokia/	Authenticated Jolokia call to BrokerService.addNetworkConnector(String) with a crafted masterslave://... brokerConfig=xbean:... triggers Spring XML loading and RCE.	CWE-94, CWE-20

22 Jul 2026 07:10Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.18.1

EPSS0.00566

SSVC