---
title: "Cve"
date: 2026-10-13
author: "Amit Agarwal"
featured_image: "https://www.meshiq.com/wp-content/uploads/featured_default.jpg"
---

# Cve

CVE Guide

# Apache ActiveMQ CVE Guide: Every Vulnerability, by Version

This is the complete list of Apache ActiveMQ® CVEs published by the Apache ActiveMQ® project – every Classic broker advisory plus the .NET client advisories, with exact affected and fixed versions and CISA exploitation status. Pick your version below to see exactly what your broker is exposed to.

[Check your version](https://www.meshiq.com/apache-activemq/enterprise-support/)[Talk to an ActiveMQ expert](https://www.meshiq.com/ebooks/apache-activemq/)**✓** Verified 9 Oct 2026 **✓** Sourced from Apache advisories **✓** Updated within 24h of new CVEs









## Trusted by industry-leading enterprise companies around the world. 

![Citi logo](https://www.meshiq.com/wp-content/uploads/logo_citi.svg)![Albertsons logo](https://www.meshiq.com/wp-content/uploads/logo_albertsons.svg)![ABN-AMRO logo](https://www.meshiq.com/wp-content/uploads/logo_abn-amro.svg)![Sodexo logo](https://www.meshiq.com/wp-content/uploads/logo_sodexo.svg)![TD Securities logo](https://www.meshiq.com/wp-content/uploads/logo_td-securities.svg)![Fiserv logo](https://www.meshiq.com/wp-content/uploads/logo_fiserv.svg)![Mizuho logo](https://www.meshiq.com/wp-content/uploads/logo_mizuho.svg)![BNY Mellon logo](https://www.meshiq.com/wp-content/uploads/logo_bny-mellon.svg)![GM Financial logo](https://www.meshiq.com/wp-content/uploads/logo_gm-financial.svg)![Societe Generale logo](https://www.meshiq.com/wp-content/uploads/logo_societe-generale.svg)![Honda logo](https://www.meshiq.com/wp-content/uploads/logo_honda.svg)![UBS logo](https://www.meshiq.com/wp-content/uploads/logo_ubs.svg)![MetLife logo](https://www.meshiq.com/wp-content/uploads/logo_metlife.svg)







## **The Three ActiveMQ CVEs in CISA’s KEV Catalog**

CISA adds a CVE to its Known Exploited Vulnerabilities catalog only with reliable evidence of active exploitation. If any of these three is open on a broker you run, treat it as an incident, not a backlog item.

CVE-2023-46604

#### OpenWire deserialization → unauthenticated RCE

CVSS

KEV added

Fixed in



9.8 NIST · 10.0 Apache (CNA)

2 Nov 2023 (due 23 Nov 2023)

5.15.16 / 5.16.7 / 5.17.6 / 5.18.3 — brokers and Java clients





Network access to the OpenWire port is enough. Exploitation began around 10 October 2023, before disclosure (Arctic Wolf), and was still in use in August 2025 by the DripDropper campaign, whose operators patched brokers themselves after getting in (Red Canary).

*Full DripDropper and exploitation-timeline breakdown coming soon in this series.*





CVE-2026-34197

#### Jolokia addNetworkConnector → RCE

Fixed in

KEV added

CVSS



5.19.4 / 6.2.3 — see follow-ups

16 Apr 2026 (due 30 Apr 2026)

8.8 (secondary scorer; no NIST score yet)





A crafted discovery URI makes the broker load a remote Spring XML context. Authenticated by default, but unauthenticated on 6.0.0–6.1.1 when chained with CVE-2024-32114 (Horizon3.ai). Three follow-up CVEs reuse the technique, so you need 5.19.7 / 6.2.6+ to close the family.

*Full breakdown of the KEV listing and the unauthenticated chain coming soon.*





CVE-2016-3088

#### Fileserver web app upload → RCE

KEV added

Fixed in

Apache rating



10 Feb 2022 (due 10 Aug 2022)

5.14.0 (Fileserver removed)

Important





The legacy Fileserver app lets an attacker write and execute files. Disabled by default since 5.12.0 and removed in 5.14.0, but long-lived brokers built from old configs can still expose it.



<a class="gb-text buttons-container_variable"></a>[NVD record →](https://nvd.nist.gov/vuln/detail/CVE-2016-3088)





#### Running a KEV-listed version in production?

meshIQ’s Apache contributor-led team can assess exposure, plan an upgrade path that doesn’t break clients, and stay on call while you cut over.



[Get expert help now](https://www.meshiq.com/apache-activemq/enterprise-support/)













## All Apache ActiveMQ CVEs

Affected and fixed versions are taken from each Apache advisory as published. Severity is Apache’s own rating where the advisory gives one; otherwise the band of the NVD CVSS v3.1 score (marked “NVD”).

CVE

Vulnerability

Severity

Affected (Classic)

Fixed in

Sources

 

CVE-2026-74761KEV

Authenticated client can spoof clientId when removing a durable topic subscription

SeverityModerateCVSS 

Affectedbefore 5.19.11 · 6.0.0 to before 6.3.2

 

Fixed in5.19.11 / 6.3.2

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-74761-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-74761)[CISA KEV](#)

 

CVE-2026-61487KEV

Authorization bypass via temporary composite destinations

SeverityImportantCVSS 

Affectedbefore 5.19.9 · 6.0.0 to before 6.2.8

 

Fixed in5.19.9 / 6.2.8 / 6.3.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-61487-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-61487)[CISA KEV](#)

 

CVE-2026-59878KEV

AMQP NIO negative frame-size validation bypass leading to DoSUnauthenticated; only if an AMQP NIO connector is reachable

SeverityModerateCVSS 

Affectedbefore 5.19.9 · 6.0.0 to before 6.2.8

 

Fixed in5.19.9 / 6.2.8 / 6.3.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-59878-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-59878)[CISA KEV](#)

 

CVE-2026-54475KEV

Temporary destination ownership takeover

SeverityImportantCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-54475-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-54475)[CISA KEV](#)

 

CVE-2026-53917KEV

Unbounded memory allocation in OpenWire property unmarshallingAuthenticated; affects activemq-client too

SeverityImportantCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-53917-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53917)[CISA KEV](#)

 

CVE-2026-53916KEV

Unbounded header buffer in STOMP NIO codecUnauthenticated

SeverityImportantCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-53916-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53916)[CISA KEV](#)

 

CVE-2026-52760KEV

Stored XSS via unescaped message ID in the Web Console

SeverityModerateCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-52760-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-52760)[CISA KEV](#)

 

CVE-2026-50750KEV

Pre-authentication OpenWire DoS introduced by the CVE-2026-49270 fixAffects only 5.19.7 and 6.2.6

SeverityImportantCVSS 

Affected5.19.7 only · 6.2.6 only

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-50750-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50750)[CISA KEV](#)

 

CVE-2026-50734KEV

Pre-authentication OpenWire memory-allocation DoS during wire-format negotiationUnauthenticated

SeverityImportantCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-50734-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50734)[CISA KEV](#)

 

CVE-2026-49877KEV

Low-privilege web users retain /admin access in the Web Console by default

SeverityImportantCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-49877-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-49877)[CISA KEV](#)

 

CVE-2026-49434KEV

LdapNetworkConnector instantiates denied transports and a remote-properties brokerRequires write access to matching LDAP entries

SeverityModerateCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-49434-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-49434)[CISA KEV](#)

 

CVE-2026-49432KEV

STOMP negative content-length enables denial of serviceUnauthenticated

SeverityImportantCVSS 

Affectedbefore 5.19.8 · 6.0.0 to before 6.2.7

 

Fixed in5.19.8 / 6.2.7

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-49432-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-49432)[CISA KEV](#)

 

CVE-2026-49270KEV

Durable subscription disclosure via crafted BrokerInfo (OpenWire)Unauthenticated; only with a network connector using syncDurableSubs=true

SeverityModerateCVSS 

Affected5.14.0 to before 5.19.7 · 6.0.0 to before 6.2.6

 

Fixed in5.19.7 / 6.2.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-49270-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-49270)[CISA KEV](#)

 

CVE-2026-49157KEV

Low-privilege web users retain Jolokia broker-management operations by default

SeverityImportantCVSS 8.8 secondary

Affectedbefore 5.19.7 · 6.0.0 to before 6.2.6

 

Fixed in5.19.7 / 6.2.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-49157)[CISA KEV](#)

 

CVE-2026-46605KEV

Incomplete authorization during destination removal

SeverityModerateCVSS 

Affectedbefore 5.19.7 · 6.0.0 to before 6.2.6

 

Fixed in5.19.7 / 6.2.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-46605-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-46605)[CISA KEV](#)

 

CVE-2026-45505KEV

Jolokia addNetworkConnector discovery-wrapper bypass of the CVE-2026-34197 fix → RCEAuthenticated

SeverityImportantCVSS 8.8 secondary

Affectedbefore 5.19.7 · 6.0.0 to before 6.2.6

 

Fixed in5.19.7 / 6.2.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-45505)[CISA KEV](#)

 

CVE-2026-42588KEV

RCE via Jolokia addNetworkConnector (masterslave: discovery URI)Authenticated

SeverityImportantCVSS 8.1 secondary

Affectedbefore 5.19.7 · 6.0.0 to before 6.2.6

 

Fixed in5.19.7 / 6.2.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-42588-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-42588)[CISA KEV](#)

 

CVE-2026-42253KEV

HTTP response header injection via JMS message properties (MessageServlet)MessageServlet now deprecated and disabled by default

SeverityImportantCVSS 

Affectedbefore 5.19.7 · 6.0.0 to before 6.2.6

 

Fixed in5.19.7 / 6.2.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-42253-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-42253)[CISA KEV](#)

 

CVE-2026-41044KEV

Web Console broker-name validation bypass → remote Spring XML → RCE (triggered via DestinationView MBean)Authenticated

SeverityImportantCVSS 8.8 secondary

Affectedbefore 5.19.6 · 6.0.0 to before 6.2.5

 

Fixed in5.19.6 / 6.2.5

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-41044)[CISA KEV](#)

 

CVE-2026-41043KEV

Web Console XSS when browsing queues

SeverityImportantCVSS 

Affectedbefore 5.19.6 · 6.0.0 to before 6.2.5

 

Fixed in5.19.6 / 6.2.5

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-41043)[CISA KEV](#)

 

CVE-2026-40466KEV

HTTP discovery second-stage URI bypass of the CVE-2026-34197 fix → RCEAuthenticated; requires activemq-http on the classpath

SeverityImportantCVSS 8.8 secondary

Affectedbefore 5.19.6 · 6.0.0 to before 6.2.5

 

Fixed in5.19.6 / 6.2.5

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-40466-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-40466)[CISA KEV](#)

 

CVE-2026-40046KEV

Missed 6.x fix for CVE-2025-66168 (MQTT Remaining Length validation)Only brokers with an MQTT connector enabled

SeverityModerateCVSS 

Affected6.0.0 to before 6.2.4

 

Fixed in6.2.4

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-40046)[CISA KEV](#)

 

CVE-2026-39304KEV

Incorrect TLSv1.3 KeyUpdate handling causes OOM DoS (NIO SSL)Apache recommends 5.19.5, though its affected range ends before 5.19.4

SeverityImportantCVSS 

Affectedbefore 5.19.4 · 6.0.0 to before 6.2.4

 

Fixed in5.19.5 / 6.2.4

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-39304)[CISA KEV](#)

 

CVE-2026-34197KEV

Jolokia addNetworkConnector crafted discovery URI loads remote Spring XML → RCEAuthenticated; unauthenticated on 6.0.0–6.1.1 via CVE-2024-32114

SeverityImportantCVSS 8.8 secondary

Affectedbefore 5.19.4 · 6.0.0 to before 6.2.3

 

Fixed in5.19.4 / 6.2.3 (bypasses fixed in 5.19.7 / 6.2.6)

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-34197)[CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197)

 

CVE-2026-33227KEV

Classpath path traversal via user-supplied key (STOMP consumer, Web Console browse)5.19.3 / 6.2.2 fix it on non-Windows hosts only

SeverityLowCVSS 

Affectedbefore 5.19.3 · 6.0.0 to before 6.2.2

 

Fixed in5.19.4 / 6.2.3

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-33227)[CISA KEV](#)

 

CVE-2025-66168KEV

MQTT control packet Remaining Length not validatedPost-authentication; only with MQTT enabled

SeverityHighNVDCVSS 8.8 NIST · 5.4 Apache

Affectedbefore 5.19.2 · 6.0.0 to before 6.1.9 · 6.2.0 only

 

Fixed in5.19.2 / 6.2.4 (see CVE-2026-40046)

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2025-66168-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-66168)[CISA KEV](#)

 

CVE-2025-27533KEV

OpenWire buffer length unchecked → memory-exhaustion DoSMitigated by mutual TLS

SeverityHighNVDCVSS 7.5 NIST

Affected5.16.0 to before 5.16.8 · 5.17.0 to before 5.17.7 · 5.18.0 to before 5.18.7 · 6.0.0 to before 6.1.6

 

Fixed in5.16.8 / 5.17.7 / 5.18.7 / 5.19.0 / 6.1.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2025-27533-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-27533)[CISA KEV](#)

 

CVE-2024-32114KEV

6.x default config leaves the Jolokia and REST API web context unauthenticatedEnables unauthenticated CVE-2026-34197

SeverityHighNVDCVSS 8.8 NIST · 8.5 Apache

Affected6.0.0 to before 6.1.2

 

Fixed in6.1.2

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-32114)[CISA KEV](#)

 

CVE-2023-46604KEV

OpenWire marshaller deserialization → unauthenticated RCE on broker or Java clientUpgrade Java clients too. Artemis bundled the code; fixed in Artemis 2.31.2

SeverityCriticalNVDCVSS 9.8 NIST · 10.0 Apache

Affectedbefore 5.15.16 · 5.16.0 to before 5.16.7 · 5.17.0 to before 5.17.6 · 5.18.0 to before 5.18.3

 

Fixed in5.15.16 / 5.16.7 / 5.17.6 / 5.18.3

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-46604)[CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604)

 

CVE-2022-41678KEV

Authenticated Jolokia → FlightRecorder MBean → JSP write → RCE

SeverityHighNVDCVSS 8.8 NIST

Affectedbefore 5.16.6 · 5.17.0 to before 5.17.4

 

Fixed in5.16.6 / 5.17.4 / 5.18.0 / 6.0.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-41678)[CISA KEV](#)

 

CVE-2021-26117KEV

LDAP login module with anonymous bind skips the password checkOnly when LDAP is used with anonymous bind

SeverityHighNVDCVSS 7.5 NIST

Affectedbefore 5.15.14 · 5.16.0 only

 

Fixed in5.15.14 / 5.16.1 (Artemis 2.16.0)

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2021-26117-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-26117)[CISA KEV](#)

 

CVE-2020-13947KEV

Web Console XSS (message.jsp)

SeverityMediumCVSS 

Affectedbefore 5.15.14 · 5.16.0 only

 

Fixed in5.15.14 / 5.16.1

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2020-13947-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-13947)[CISA KEV](#)

 

CVE-2020-13920KEV

JMX RMI registry rebind enables man-in-the-middle credential capture

SeverityModerateCVSS 

Affectedbefore 5.15.12

 

Fixed in5.15.12

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-13920)[CISA KEV](#)

 

CVE-2020-11998KEV

JMX regression lets a remote client load MBeans from arbitrary URLsAffects only 5.15.12

SeverityModerateCVSS 

Affected5.15.12 only

 

Fixed in5.15.13

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11998)[CISA KEV](#)

 

CVE-2020-1941KEV

Web Console XSS (queue contents view)

SeverityMediumCVSS 

Affectedbefore 5.15.12

 

Fixed in5.15.12

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2020-1941-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-1941)[CISA KEV](#)

 

CVE-2019-0222KEV

Corrupt MQTT frame causes broker OOM

SeverityImportantCVSS 

Affectedbefore 5.15.9

 

Fixed in5.15.9

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2019-0222-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-0222)[CISA KEV](#)

 

CVE-2018-8006KEV

Web Console XSS (queue.jsp QueueFilter)

SeverityImportantCVSS 

Affectedbefore 5.15.6

 

Fixed in5.15.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2018-8006-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-8006)[CISA KEV](#)

 

CVE-2018-11775KEV

Client missing TLS hostname verification → MITM

SeverityImportantCVSS 

Affectedbefore 5.15.6

 

Fixed in5.15.6

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-11775)[CISA KEV](#)

 

CVE-2017-15709KEV

OpenWire exposes OS and kernel details in plaintext

SeverityLowCVSS 

Affected5.14.0 to before 5.15.3

 

Fixed in5.15.3

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2017-15709-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-15709)[CISA KEV](#)

 

CVE-2016-6810KEV

Web Console XSS

SeverityImportantCVSS 

Affectedbefore 5.14.2

 

Fixed in5.14.2

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2016-6810-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-6810)[CISA KEV](#)

 

CVE-2016-3088KEV

Fileserver web application upload → RCEFileserver disabled by default since 5.12.0

SeverityImportantCVSS 

Affectedbefore 5.14.0

 

Fixed in5.14.0 (Fileserver removed)

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-3088)[CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088)

 

CVE-2016-0734KEV

Web Console clickjacking (no X-Frame-Options)

SeverityImportantCVSS 

Affectedbefore 5.13.2

 

Fixed in5.13.2

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-0734)[CISA KEV](#)

 

CVE-2016-0782KEV

Web Console XSS and Jolokia memory-dump write

SeverityImportantCVSS 

Affectedbefore 5.11.4 · 5.12.0 to before 5.12.3 · 5.13.0 only

 

Fixed in5.11.4 / 5.12.3 / 5.13.1

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-0782)[CISA KEV](#)

 

CVE-2015-7559KEV

Remote shutdown command causes client DoS

SeverityLowCVSS 

Affectedbefore 5.14.5

 

Fixed in5.14.5

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2015-7559-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-7559)[CISA KEV](#)

 

CVE-2015-5254KEV

Unsafe ObjectMessage deserialization in the broker

SeverityImportantCVSS 

Affectedbefore 5.13.0

 

Fixed in5.13.0 (+ trusted-packages config)

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-5254)[CISA KEV](#)

 

CVE-2015-1830KEV

Fileserver path traversal → unauthenticated RCEWindows hosts only

SeverityImportantCVSS 

Affectedbefore 5.11.2

 

Fixed in5.11.2 / 5.12.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-1830)[CISA KEV](#)

 

CVE-2014-3576KEV

Remote unauthenticated broker shutdown

SeverityImportantCVSS 

Affectedbefore 5.10.2

 

Fixed in5.11.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2014-3576-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-3576)[CISA KEV](#)

 

CVE-2014-3600KEV

XXE via XPath selectors

SeverityImportantCVSS 

Affectedbefore 5.10.1

 

Fixed in5.10.1 / 5.11.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-3600)[CISA KEV](#)

 

CVE-2014-3612KEV

LDAPLoginModule accepts empty passwords and wildcard usernames

SeverityImportantCVSS 

Affectedbefore 5.10.1

 

Fixed in5.10.1 / 5.11.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-3612)[CISA KEV](#)

 

CVE-2014-8110KEV

Web Console XSS

SeverityImportantCVSS 

Affectedbefore 5.10.1

 

Fixed in5.10.1 / 5.11.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2014-8110-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-8110)[CISA KEV](#)

 

CVE-2025-54539KEV

NMS AMQP Client (.NET) deserialization → client RCE from a malicious broker

SeverityImportantCVSS 9.8 secondary

AffectedNMS AMQP Client through 2.3.0

 

Fixed inNMS AMQP 2.4.0

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2025-54539-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54539)[CISA KEV](#)

 

CVE-2025-29953KEV

NMS OpenWire Client (.NET) deserialization allowlist bypass

SeverityModerateCVSS 9.8 secondary

AffectedNMS OpenWire Client before 2.1.1

 

Fixed inNMS OpenWire 2.1.1

[Full breakdown →](#)[Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2025-29953-announcement.txt)[NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-29953)[CISA KEV](#)

 

 

 

No CVEs match these filters.









## meshIQ Console for Apache ActiveMQ®

A modern, enterprise-grade web console for monitoring and managing your ActiveMQ® and Artemis brokers – real-time visibility, insights, and analytics in one unified interface that goes well beyond open-source alternatives.



### **Live broker health dashboard**

INFO, WARNING, and ERROR event counts with visual summary cards and interactive event-flow charts to spot trends and correlate incidents.







### ********Granular queue visibility********

track queue size, enqueue/dequeue rates, in-flight message counts, and backlogs to instantly surface bottlenecks or abnormal growth.







### **********Topology visualisation**********



map broker topologies, active/passive roles, and network connectors at a glance.







### Live ****metric trends**** 

Track any broker or queue metric (depth, enqueue/dequeue rate, in-flight counts) as a live time-series line chart, so you see how values evolve over time and catch threshold breaches before they escalate.







### ****Alert visibility**** and ****notifications**** 

View alerts in real time when monitor conditions are triggered, helping teams quickly identify and respond to potential issues.









![](https://www.meshiq.com/wp-content/uploads/Live-Broker-Health-Dashboard.png)    





![](https://www.meshiq.com/wp-content/uploads/Granular-Queue-Visibility.png)    





![](https://www.meshiq.com/wp-content/uploads/Topology.jpg)    





![](https://www.meshiq.com/wp-content/uploads/Metric-Trends.gif)    





![](https://www.meshiq.com/wp-content/uploads/Alert-Visibility.png)    





![](https://www.meshiq.com/wp-content/uploads/screenshot_On-prem-cloud-kubernetes.jpg)    









[Request a Demo](https://www.meshiq.com/request-a-demo/)







## ****Four attack surfaces account for most ActiveMQ CVEs****

Read as a list, 52 advisories look random. Grouped by where they enter the broker, they point at a short list of controls that would have blunted most of them.

### 1. Jolokia and the management API

Eight advisories since 2022 run through Jolokia, the JMX-over-HTTP bridge behind the web console. In 2026 the same remote-Spring-XML payload came back four more times after CVE-2026-34197 — two direct bypasses of its fix (40466, 45505), a masterslave variant (42588) and a web-console route (41044). The lasting answer is a restrictive `jolokia-access.xml` (default from 5.19.7 / 6.2.6), not just the next patch.

2022-41678 · 2024-32114 · 2026-34197 · 2026-40466 · 2026-41044 · 2026-45505 · 2026-42588 · 2026-49157

*We’ll walk the full Jolokia CVE chain in an upcoming post in this series.*





### 2. Wire-protocol parsing (OpenWire, STOMP, AMQP, MQTT)

Most protocol bugs are unauthenticated memory-exhaustion DoS triggered by an unchecked size field — and CVE-2023-46604 shows how far a parsing flaw can go. Before 5.19.7 / 6.2.6, the default config opened five protocol connectors; disabling the ones you don’t use removes whole rows from this table.

2023-46604 · 2025-27533 · 2026-50734 · 2026-50750 · 2026-53917 · 2026-53916 · 2026-49432 · 2026-59878 · 2025-66168 · 2026-40046 · 2026-39304

*We’ll cover CVE-2025-27533 and mutual TLS in an upcoming post.*





### ****3. The web console****

XSS, header injection and broken role separation recur from 2014 to 2026. The console binds to 127.0.0.1 by default since 5.16.0 and ships with `admin/admin`; inherited configs often undo the first and keep the second.

2026-41043 · 2026-52760 · 2026-42253 · 2026-49877 · 2020-13947 · 2020-1941 · 2018-8006 · 2016-6810 · 2016-0734 · 2016-0782 · 2014-8110





### ****4. Authentication and authorization logic****

From LDAP anonymous binds to temporary-destination ownership, these let a connected or low-privilege client do more than its ACL allows. They rarely make headlines and are rarely prioritized — which is why they persist.

2021-26117 · 2014-3612 · 2026-61487 · 2026-54475 · 2026-46605 · 2026-74761

*We’ll cover the LDAP anonymous-bind bypass in an upcoming post.*









We covered the configuration side in depth — TLS on every connector, JAAS and LDAP authentication, destination authorization, console and Jolokia lockdown, and network isolation. Read the ActiveMQ Security Hardening Guide →

The .NET side has its own exposure: CVE-2025-54539 and CVE-2025-29953 let a malicious broker compromise NMS clients. We’ll cover both .NET client CVEs in an upcoming post. For what the 2026 wave means for 2027 planning, see our upcoming 2026 ActiveMQ security roundup.







## Why meshIQ Apache ActiveMQ® support is different

The difference between a vendor who reads the docs and a team who writes the code.



### Working closely with Apache Contributors

Our engineers hold Apache contributor status and actively contribute to Apache ActiveMQ®, Apache Artemis™ and Apache Camel™. When your issue requires upstream knowledge, we have it – no escalation to a third party.







### ******Named engineer, not a ticket queue****** 

Every Professional and Enterprise customer has a named Technical Account Manager and a dedicated engineer. You talk to a person, not a bot or a rotating helpdesk.







### ********SLA with financial backing********



Our SLAs are contractually guaranteed with service credits. If we miss a P1 response time, you receive automatic credit against your next invoice. No arguments, no forms.







### Proactive, not reactive

meshIQ monitoring detects anomalies before they cause outages. Most P1 incidents in our portfolio are resolved before the client is even aware there was a problem.







### Vendor-neutral by principle

We don’t sell proprietary middleware or try to migrate you off open-source. Our only product is expertise. You get advice that serves your architecture, not our revenue.







### On-premise, cloud &amp; Kubernetes

Full support for Apache ActiveMQ® deployments on bare metal, VMware, AWS, Azure, GCP, and Kubernetes — including Helm chart deployment patterns and operator-managed clusters.









![](https://www.meshiq.com/wp-content/uploads/screenshot_Apache-committers.jpg)    





![](https://www.meshiq.com/wp-content/uploads/screenshot_Named-Engineer.jpg)    





![](https://www.meshiq.com/wp-content/uploads/screenshot_SLA-with-financial-backing.jpg)    





![](https://www.meshiq.com/wp-content/uploads/screenshot_Proactive.jpg)    





![](https://www.meshiq.com/wp-content/uploads/screenshot_Vendor-Neutral.jpg)    





![](https://www.meshiq.com/wp-content/uploads/screenshot_On-prem-cloud-kubernetes.jpg)    













## **Apache ActiveMQ® for your industry**

Purpose-built expertise for the sectors where high-throughput, reliable messaging is mission-critical.



Financial Services

Retail &amp; E-comm

Logistics &amp; Supply

Manufacturing



### Apache ActiveMQ® for financial services

Financial institutions rely on Apache ActiveMQ® for trade order routing, real-time settlement messaging, and regulatory reporting pipelines. meshIQ ensures your Apache ActiveMQ® environment meets FIX protocol requirements, achieves sub-millisecond latency targets, and satisfies audit trail obligations under MiFID II, DORA, and SOX.[](#)

[Learn More →](https://www.meshiq.com/apache-activemq/industry/finance-and-banking/)

![](https://www.meshiq.com/wp-content/uploads/featured_success-story_finance-Servicess.jpg)    





### Apache ActiveMQ® for retail &amp; e-commerce

Retail platforms use Apache ActiveMQ® to synchronize inventory across thousands of SKUs, process order events at peak-season scale, and connect storefronts with warehouse management systems. meshiq supports Black Friday-level throughput planning and seamless ERP integration.  
[](#)

[Learn More →](https://www.meshiq.com/apache-activemq/industry/retail-and-ecommerce/)

![](https://www.meshiq.com/wp-content/uploads/featured_success-story_retail_e-ommerce.jpg)    





### Apache ActiveMQ® for logistics &amp; supply chain

Logistics operators depend on Apache ActiveMQ® for real-time shipment tracking, carrier EDI integration, and warehouse event streaming. meshiq builds resilient multi-site broker networks that keep your supply chain visible and reactive around the clock.[](#)

[Learn More →](https://www.meshiq.com/apache-activemq/industry/logistics-and-supply-chain/)

![](https://www.meshiq.com/wp-content/uploads/featured_success-story_logistics_-Supply-Chain.jpg)    





### Apache ActiveMQ® for manufacturing

Manufacturers deploy Apache ActiveMQ® to connect IoT sensors, SCADA systems, and MES platforms across factory floors. meshiq designs durable, high-availability topologies that ensure zero message loss even during network partitions or scheduled maintenance windows.[](#)

[Learn More →](https://www.meshiq.com/apache-activemq/industry/manufacturing/)

![](https://www.meshiq.com/wp-content/uploads/featured_success-story_manufacturings.jpg)    













## Our clients say it best.  
Read our G2 customer reviews.

Hear what our reviews — or leave your own review at G2. [More reviews at G2](https://www.g2.com/products/meshiq/reviews).

[![Shield-shaped badge with the title Milestone at the top, the G2 logo in the upper right, and bold text reading Users Love Us above three red stars.](https://www.meshiq.com/wp-content/uploads/badge_g2_users-love-us.png)](https://www.g2.com/products/meshiq/reviews)[![A badge with the text High Performer and the G2 logo in the top right corner, featuring red and yellow stripes at the bottom.](https://www.meshiq.com/wp-content/uploads/badge_g2_high-performer.png)](https://www.g2.com/products/meshiq/reviews)[![A badge labeled G2 with the title High Performer Mid-Market in black text, featuring red, orange, and yellow stripes at the bottom.](https://www.meshiq.com/wp-content/uploads/badge_g2_high-performer-mid-market.png)](https://www.g2.com/products/meshiq/reviews)[![G2 badge with High Performer Enterprise in bold black text in the center, over a white background with yellow, orange, and red stripes at the bottom.](https://www.meshiq.com/wp-content/uploads/badge_g2_high-performer-enterprise.png)](https://www.g2.com/products/meshiq/reviews)





## Resources



![](https://www.meshiq.com/wp-content/uploads/icon_blog.svg)    ### Apache ActiveMQ® Blog

Practical insights, performance strategies, and messaging best practices to help teams optimize Apache ActiveMQ®, Apache Artemis™, Apache Camel™, and modern event-driven architectures.

[Explore Blogs](https://www.meshiq.com/blog/?_category=active-mq)



![](https://www.meshiq.com/wp-content/uploads/icon_ebook.svg)    ### Apache ActiveMQ® eBooks

In-depth guides and expert resources covering Apache ActiveMQ®, Artemis™, Camel™ enterprise messaging, operational efficiency, compliance, scalability, and modernization for distributed systems.

[Explore eBooks](https://www.meshiq.com/ebooks/?_category-topics=apache-activemq)



![](https://www.meshiq.com/wp-content/uploads/icon_case-study.svg)    ### Apache ActiveMQ® Case Study

Real-world success stories showing how organizations solved messaging complexity, improved reliability, reduced costs, and scaled mission-critical operations with Apache ActiveMQ®.

[Explore Success Stories](https://www.meshiq.com/success-stories/)









## See what every broker is doing — not just what version it runs

meshIQ Console for Apache ActiveMQ® gives you live broker health, queue-level visibility, topology and alerting across ActiveMQ and Artemis, so an anomalous connection or memory spike gets noticed before it becomes an outage.



[Request a Demo](https://www.meshiq.com/apache-activemq/enterprise-support/)



Live broker health dashboard

INFO, WARNING and ERROR event counts with event-flow charts



Granular queue visibility

Queue size, enqueue/dequeue rates, in-flight counts and backlogs



Alert visibility and notifications

Real-time alerts when monitor conditions trigger









## ****Frequently Asked Questions about Apache ActiveMQ CVE****

Quick answers to the questions our clients ask most often.



**How do I check whether my Apache ActiveMQ version is vulnerable?**

Find your exact broker version — it’s in the JAR file names under `lib/` (for example `activemq-broker-6.2.4.jar`) and in the broker startup log — then compare it with the affected range in each Apache advisory. The [version checker](#checker) above does that comparison against all 50 Classic broker advisories. Also check the `activemq-client` version in your Java applications: several advisories, including CVE-2023-46604, affect clients as well as brokers.







********Which Apache ActiveMQ versions have no known CVEs?********

As of 9 October 2026, only 5.19.11 (released 5 September 2026) and 6.3.2 (released 2 September 2026) sit outside the affected range of every published advisory. CVE-2026-74761 is fixed only in those two releases, so even 6.2.10 — the final 6.2.x release — remains exposed.







**Which Apache ActiveMQ CVEs are actively exploited?**

Three are listed in CISA’s Known Exploited Vulnerabilities catalog: CVE-2023-46604 (OpenWire RCE), CVE-2026-34197 (Jolokia RCE) and CVE-2016-3088 (Fileserver upload). Four later CVEs (40466, 41044, 42588, 45505) reuse the 34197 remote-Spring-XML technique, so assume attackers will try them too.







**Is Apache ActiveMQ 6.2.x still supported?**

Apache lists 6.2.x as Inactive — end-of-life, with no further community updates. The same applies to 6.1.x, 6.0.x, 5.18.x and every older series. Only 6.3.x and 5.19.x are Active. Staying on an Inactive series means any future advisory will stay open unless you upgrade or have a support provider that backports fixes.









**Does this list cover Apache ActiveMQ Artemis?**

No. Artemis is now a separate Apache top-level project with its own advisories at artemis.apache.org. This page covers ActiveMQ Classic brokers and the NMS .NET clients. Two entries here also affected Artemis: CVE-2023-46604 (Artemis bundled the vulnerable code; fixed in 2.31.2) and CVE-2021-26117 (fixed in Artemis 2.16.0).















## ****How this list is maintained****

- **Scope:** every advisory on Apache’s [ActiveMQ Classic security page](https://activemq.apache.org/components/classic/security) (52 as of 9 Oct 2026). Affected ranges and fixed versions are transcribed from each advisory’s announcement file; where Apache’s affected range and upgrade advice differ, both are shown.
- **Severity:** Apache’s own rating (Important / Moderate / Medium / Low) where the advisory gives one. Where it doesn’t, the NVD CVSS v3.1 base score band, labeled “NVD”.
- **CVSS scores:** “NIST” is NVD’s primary score; “Apache” is the CNA score on the NVD record; “secondary” is a score from another scorer on the NVD record where NIST has not yet scored.
- **Exploitation:** marked only for CVEs in CISA’s [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).
- **Release status:** Active / Inactive as listed on Apache’s [download page](https://activemq.apache.org/components/classic/download/).

The checker is a reference aid, not a scanner: it doesn’t see your configuration, which connectors you expose, or whether a backported fix is applied. Found an error? [Tell us](https://www.meshiq.com/contact-us/) and we’ll correct it within one business day.







## Stuck on an end-of-life ActiveMQ release?

Most brokers we see aren’t one patch behind — they’re a series behind, with clients and configs that make upgrading risky. meshIQ’s Apache contributor-led team plans and runs that upgrade with you, with SLA-backed 24/7 support behind it.

[Talk to an ActiveMQ expert](https://www.meshiq.com/apache-activemq/enterprise-support/)[See ActiveMQ support plans](https://www.meshiq.com/apache-activemq/enterprise-support/)