CVE Guide
Apache ActiveMQ CVE Guide: Every Vulnerability, by Version
This is the complete list of Apache ActiveMQ® CVEs published by the Apache ActiveMQ® project – every Classic broker advisory plus the .NET client advisories, with exact affected and fixed versions and CISA exploitation status. Pick your version below to see exactly what your broker is exposed to.
Trusted by industry-leading enterprise companies around the world.
The Three ActiveMQ CVEs in CISA’s KEV Catalog
CISA adds a CVE to its Known Exploited Vulnerabilities catalog only with reliable evidence of active exploitation. If any of these three is open on a broker you run, treat it as an incident, not a backlog item.
CVE-2023-46604
OpenWire deserialization → unauthenticated RCE
CVSS
KEV added
Fixed in
9.8 NIST · 10.0 Apache (CNA)
2 Nov 2023 (due 23 Nov 2023)
5.15.16 / 5.16.7 / 5.17.6 / 5.18.3 — brokers and Java clients
Network access to the OpenWire port is enough. Exploitation began around 10 October 2023, before disclosure (Arctic Wolf), and was still in use in August 2025 by the DripDropper campaign, whose operators patched brokers themselves after getting in (Red Canary).
Full DripDropper and exploitation-timeline breakdown coming soon in this series.
CVE-2026-34197
Jolokia addNetworkConnector → RCE
Fixed in
KEV added
CVSS
5.19.4 / 6.2.3 — see follow-ups
16 Apr 2026 (due 30 Apr 2026)
8.8 (secondary scorer; no NIST score yet)
A crafted discovery URI makes the broker load a remote Spring XML context. Authenticated by default, but unauthenticated on 6.0.0–6.1.1 when chained with CVE-2024-32114 (Horizon3.ai). Three follow-up CVEs reuse the technique, so you need 5.19.7 / 6.2.6+ to close the family.
Full breakdown of the KEV listing and the unauthenticated chain coming soon.
CVE-2016-3088
Fileserver web app upload → RCE
KEV added
Fixed in
Apache rating
10 Feb 2022 (due 10 Aug 2022)
5.14.0 (Fileserver removed)
Important
The legacy Fileserver app lets an attacker write and execute files. Disabled by default since 5.12.0 and removed in 5.14.0, but long-lived brokers built from old configs can still expose it.
Running a KEV-listed version in production?
All Apache ActiveMQ CVEs
Affected and fixed versions are taken from each Apache advisory as published. Severity is Apache’s own rating where the advisory gives one; otherwise the band of the NVD CVSS v3.1 score (marked “NVD”).
meshIQ Console for Apache ActiveMQ®
A modern, enterprise-grade web console for monitoring and managing your ActiveMQ® and Artemis brokers – real-time visibility, insights, and analytics in one unified interface that goes well beyond open-source alternatives.
Four attack surfaces account for most ActiveMQ CVEs
Read as a list, 52 advisories look random. Grouped by where they enter the broker, they point at a short list of controls that would have blunted most of them.
1. Jolokia and the management API
Eight advisories since 2022 run through Jolokia, the JMX-over-HTTP bridge behind the web console. In 2026 the same remote-Spring-XML payload came back four more times after CVE-2026-34197 — two direct bypasses of its fix (40466, 45505), a masterslave variant (42588) and a web-console route (41044). The lasting answer is a restrictive jolokia-access.xml (default from 5.19.7 / 6.2.6), not just the next patch.
2022-41678 · 2024-32114 · 2026-34197 · 2026-40466 · 2026-41044 · 2026-45505 · 2026-42588 · 2026-49157
We’ll walk the full Jolokia CVE chain in an upcoming post in this series.
2. Wire-protocol parsing (OpenWire, STOMP, AMQP, MQTT)
Most protocol bugs are unauthenticated memory-exhaustion DoS triggered by an unchecked size field — and CVE-2023-46604 shows how far a parsing flaw can go. Before 5.19.7 / 6.2.6, the default config opened five protocol connectors; disabling the ones you don’t use removes whole rows from this table.
2023-46604 · 2025-27533 · 2026-50734 · 2026-50750 · 2026-53917 · 2026-53916 · 2026-49432 · 2026-59878 · 2025-66168 · 2026-40046 · 2026-39304
We’ll cover CVE-2025-27533 and mutual TLS in an upcoming post.
3. The web console
XSS, header injection and broken role separation recur from 2014 to 2026. The console binds to 127.0.0.1 by default since 5.16.0 and ships with admin/admin; inherited configs often undo the first and keep the second.
2026-41043 · 2026-52760 · 2026-42253 · 2026-49877 · 2020-13947 · 2020-1941 · 2018-8006 · 2016-6810 · 2016-0734 · 2016-0782 · 2014-8110
4. Authentication and authorization logic
From LDAP anonymous binds to temporary-destination ownership, these let a connected or low-privilege client do more than its ACL allows. They rarely make headlines and are rarely prioritized — which is why they persist.
2021-26117 · 2014-3612 · 2026-61487 · 2026-54475 · 2026-46605 · 2026-74761
We’ll cover the LDAP anonymous-bind bypass in an upcoming post.
We covered the configuration side in depth — TLS on every connector, JAAS and LDAP authentication, destination authorization, console and Jolokia lockdown, and network isolation. Read the ActiveMQ Security Hardening Guide →
The .NET side has its own exposure: CVE-2025-54539 and CVE-2025-29953 let a malicious broker compromise NMS clients. We’ll cover both .NET client CVEs in an upcoming post. For what the 2026 wave means for 2027 planning, see our upcoming 2026 ActiveMQ security roundup.
Why meshIQ Apache ActiveMQ® support is different
The difference between a vendor who reads the docs and a team who writes the code.
Apache ActiveMQ® for your industry
Purpose-built expertise for the sectors where high-throughput, reliable messaging is mission-critical.
Apache ActiveMQ® for financial services
Financial institutions rely on Apache ActiveMQ® for trade order routing, real-time settlement messaging, and regulatory reporting pipelines. meshIQ ensures your Apache ActiveMQ® environment meets FIX protocol requirements, achieves sub-millisecond latency targets, and satisfies audit trail obligations under MiFID II, DORA, and SOX.
Learn More →
Apache ActiveMQ® for retail & e-commerce
Retail platforms use Apache ActiveMQ® to synchronize inventory across thousands of SKUs, process order events at peak-season scale, and connect storefronts with warehouse management systems. meshiq supports Black Friday-level throughput planning and seamless ERP integration.
Apache ActiveMQ® for logistics & supply chain
Logistics operators depend on Apache ActiveMQ® for real-time shipment tracking, carrier EDI integration, and warehouse event streaming. meshiq builds resilient multi-site broker networks that keep your supply chain visible and reactive around the clock.
Learn More →
Apache ActiveMQ® for manufacturing
Manufacturers deploy Apache ActiveMQ® to connect IoT sensors, SCADA systems, and MES platforms across factory floors. meshiq designs durable, high-availability topologies that ensure zero message loss even during network partitions or scheduled maintenance windows.
Learn More →
Our clients say it best.
Read our G2 customer reviews.
Hear what our reviews — or leave your own review at G2. More reviews at G2.
Resources
Apache ActiveMQ® Blog
Practical insights, performance strategies, and messaging best practices to help teams optimize Apache ActiveMQ®, Apache Artemis™, Apache Camel™, and modern event-driven architectures.
Apache ActiveMQ® eBooks
In-depth guides and expert resources covering Apache ActiveMQ®, Artemis™, Camel™ enterprise messaging, operational efficiency, compliance, scalability, and modernization for distributed systems.
Apache ActiveMQ® Case Study
Real-world success stories showing how organizations solved messaging complexity, improved reliability, reduced costs, and scaled mission-critical operations with Apache ActiveMQ®.
See what every broker is doing — not just what version it runs
Live broker health dashboard
INFO, WARNING and ERROR event counts with event-flow charts
Granular queue visibility
Queue size, enqueue/dequeue rates, in-flight counts and backlogs
Alert visibility and notifications
Real-time alerts when monitor conditions trigger
Frequently Asked Questions about Apache ActiveMQ CVE
Quick answers to the questions our clients ask most often.
Find your exact broker version — it’s in the JAR file names under lib/ (for example activemq-broker-6.2.4.jar) and in the broker startup log — then compare it with the affected range in each Apache advisory. The version checker above does that comparison against all 50 Classic broker advisories. Also check the activemq-client version in your Java applications: several advisories, including CVE-2023-46604, affect clients as well as brokers.
As of 9 October 2026, only 5.19.11 (released 5 September 2026) and 6.3.2 (released 2 September 2026) sit outside the affected range of every published advisory. CVE-2026-74761 is fixed only in those two releases, so even 6.2.10 — the final 6.2.x release — remains exposed.
Three are listed in CISA’s Known Exploited Vulnerabilities catalog: CVE-2023-46604 (OpenWire RCE), CVE-2026-34197 (Jolokia RCE) and CVE-2016-3088 (Fileserver upload). Four later CVEs (40466, 41044, 42588, 45505) reuse the 34197 remote-Spring-XML technique, so assume attackers will try them too.
Apache lists 6.2.x as Inactive — end-of-life, with no further community updates. The same applies to 6.1.x, 6.0.x, 5.18.x and every older series. Only 6.3.x and 5.19.x are Active. Staying on an Inactive series means any future advisory will stay open unless you upgrade or have a support provider that backports fixes.
No. Artemis is now a separate Apache top-level project with its own advisories at artemis.apache.org. This page covers ActiveMQ Classic brokers and the NMS .NET clients. Two entries here also affected Artemis: CVE-2023-46604 (Artemis bundled the vulnerable code; fixed in 2.31.2) and CVE-2021-26117 (fixed in Artemis 2.16.0).
How this list is maintained
- Scope: every advisory on Apache’s ActiveMQ Classic security page (52 as of 9 Oct 2026). Affected ranges and fixed versions are transcribed from each advisory’s announcement file; where Apache’s affected range and upgrade advice differ, both are shown.
- Severity: Apache’s own rating (Important / Moderate / Medium / Low) where the advisory gives one. Where it doesn’t, the NVD CVSS v3.1 base score band, labeled “NVD”.
- CVSS scores: “NIST” is NVD’s primary score; “Apache” is the CNA score on the NVD record; “secondary” is a score from another scorer on the NVD record where NIST has not yet scored.
- Exploitation: marked only for CVEs in CISA’s KEV catalog.
- Release status: Active / Inactive as listed on Apache’s download page.
The checker is a reference aid, not a scanner: it doesn’t see your configuration, which connectors you expose, or whether a backported fix is applied. Found an error? Tell us and we’ll correct it within one business day.
Stuck on an end-of-life ActiveMQ release?
Most brokers we see aren’t one patch behind — they’re a series behind, with clients and configs that make upgrading risky. meshIQ’s Apache contributor-led team plans and runs that upgrade with you, with SLA-backed 24/7 support behind it.