What is CVE-2026-41043?

CVE-2026-41043 is a medium-severity vulnerability in Apache Activemq, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2026-04-24.

How severe is CVE-2026-41043?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XSS in Apache Activemq

CVE-2026-41043

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (44.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Apache Activemq
Apache Activemq_web
Apache Software Foundation Activemq — versions 0, 6.0.0
Apache Software Foundation Activemq Web — versions 0, 6.0.0

Weakness classification (CWE)

References

security@apache.org (vendor-advisory, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List)

Frequently asked questions

What is CVE-2026-41043?: CVE-2026-41043 is a medium-severity vulnerability in Apache Activemq, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2026-04-24.
How severe is CVE-2026-41043?: Medium severity. CVSS v3 base score is 6.5 out of 10.