CVE-2026-74761

Improper input validation in TopicRegion allows an authenticated client to spoof clientId when removing a durable topic subscription. This flaw in Apache ActiveMQ , Apache ActiveMQ Broker , and Apache ActiveMQ All (all platforms) can enable the unauthorized removal of other users' durable topic s...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-74761 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-74761 Source advisory: MEND:CVE-2026-74761...

CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

EUVD-2026-74829

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

PT-2026-88926

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.11 Apache ActiveMQ versions 6.0.0 through 6.3.1 Apache ActiveMQ Broker versions prior to 5.19.11 Apache ActiveMQ Broker versions 6.0.0 through 6.3.1 Apache ActiveMQ All versions prior to 5.19.11 Apache...

CVE-2026-74761: Improper Input Validation

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

Exploit for Code Injection in Apache Activemq

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector...

Apache ActiveMQ Access Control Bypass

The vulnerability of Apache ActiveMQ-related software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 ActiveMQ Safe Validator A single-file, non-des...

CLEANSTART-2026-DV18988 Security fixes in apache-activemq-artemis 2.56.0-r1

Package apache-activemq-artemis version 2.56.0-r1 fixes 15 vulnerabilities: CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-41417...

Authorization Bypass

Apache ActiveMQ is vulnerable to Authorization Bypass. The vulnerability is due to the authorization check being bypassed for temporary composite destinations, where an authenticated low‑privilege user can send messages to a temporary composite destination whose physical name is a comma‑separated...

Denial Of Service

Apache ActiveMQ is vulnerable to Denial of Service. The vulnerability is due to improper input validation of the frame size value in the AMQP NIO connector, where an attacker can send a crafted frame size that causes the NIO threads to die and, if performed rapidly, exhaust the NIO thread pool,...

org.apache.activemq:activemq-web (5.0.0), org.apache.activemq:activemq-web-console (5.0.0) +9 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (2.0.6)

org.springframework:spring-webmvc MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.activemq:activemq-web 5.0.0 - org.apache.activemq:activemq-web-console 5.0.0 -...

Security Bulletin: IBM Jazz for Service Management is affected by multiple vulnerabilities in Apache ActiveMQ

Summary IBM Jazz for Service Management is affected by multiple vulnerabilities in Apache ActiveMQ CVE-2026-59878, CVE-2026-61487 Vulnerability Details CVEID:CVE-2026-59878 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote...

Apache ActiveMQ Authentication Bypass

The vulnerability of Apache ActiveMQ software products is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 – Apache ActiveMQ Remote Code Execution Ove...

Apache ActiveMQ Integer Overflow DoS

The vulnerability of Apache ActiveMQ software products is related to integer overflow. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Improper Authorization

Apache ActiveMQ is vulnerable to Improper Authorization. The vulnerability is due to incorrect default Jetty access controls that allow low-privileged authenticated Web Console users to access /admin/ paths, which allows them to perform administrative actions without the required privileges...