Vulnerability in Apache Activemq
CVE-2026-49157
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Activemq
- Apache Software Foundation Activemq — versions 0, 6.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-49157?
- CVE-2026-49157 is a high-severity vulnerability in Apache Activemq, classified under Incorrect Default Permissions. CVSS score: 8.8/10. Published 2026-06-01.
- How severe is CVE-2026-49157?
- High severity. CVSS v3 base score is 8.8 out of 10.