CVE-2026-41044 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

🗓️ 24 Apr 2026 10:16:53Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Authenticated users can trigger remote code execution via the DestinationView MBean exposed by Jolokia in ActiveMQ by loading a malicious Spring XML context.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in activemq-all (CVE-2026-40466 and CVE-2026-41044)	27 May 202614:05	–	ibm
Tenable Nessus	Apache ActiveMQ < 5.19.6 / 6.x < 6.2.5 Multiple Vulnerabilities	30 Apr 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-41044	24 Apr 202600:00	–	nessus
ATTACKERKB	CVE-2026-41044	24 Apr 202610:16	–	attackerkb
Atlassian	RCE (Remote Code Execution) org.apache.activemq:activemq-broker Dependency in Bamboo Data Center	11 Jun 202617:59	–	atlassian
BDU FSTEC	The vulnerability of the administration console of the broker’s messaging software platform Apache ActiveMQ allows a hacker to execute arbitrary code.	8 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-41044 vulnerabilities	14 May 202607:17	–	cgr
Circl	CVE-2026-41044	23 Apr 202618:30	–	circl
CNNVD	Apache多款产品输入验证错误漏洞	24 Apr 202600:00	–	cnnvd
CVE	CVE-2026-41044	24 Apr 202610:16	–	cve

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/04/23/6
repo	www.repo.maven.apache.org/maven2
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41044.json
access	www.access.redhat.com/security/cve/CVE-2026-41044
activemq	www.activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41044.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41044
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

16 Jul 2026 03:31Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.8

EPSS0.0098