--- title: "Apache ActiveMQ® CVE Guide: Complete Vulnerability Reference" date: 2026-10-26 author: "Amit Agarwal" featured_image: "https://www.meshiq.com/wp-content/uploads/blog_activeMQ-CVE-Guide_10232026.jpg" categories: - name: "Apache ActiveMQ®" url: "/sort-by/active-mq.md" - name: "Messaging" url: "/sort-by/messaging.md" - name: "Middleware" url: "/sort-by/middleware.md" - name: "Middleware Optimization" url: "/sort-by/middleware-optimization.md" --- # Apache ActiveMQ® CVE Guide: Complete Vulnerability Reference Every row was checked against Apache’s own advisory files and the NVD record, not against news coverage. It is the hub for our CVE series, so each entry links to a full breakdown as those posts publish. ## How to read this Apache ActiveMQ® CVE index Three details trip up most patch decisions, so they are made explicit here. **Scores come from more than one place.** Apache does not publish a CVSS score in most of its Apache ActiveMQ® security advisories. NVD often shows NIST’s own score, a secondary score from another scorer, or both. We label which one we cite. Where they disagree sharply, we show both: CVE-2025-66168, for example, is 8.8 from NIST and 5.4 from Apache. **“Fixed in” is not the same as “safe.”** It is the first release that closes that one CVE. A later advisory can reopen the same code path. CVE-2026-34197 is the clearest case: Apache titles two later CVEs as bypasses of its fix, and a third reaches RCE through the same Jolokia operation. **Scope is Apache ActiveMQ® Classic and the NMS clients.** Apache Artemis™ became a separate Apache top-level project and now publishes its own advisories at [artemis.apache.org](https://artemis.apache.org/). Apache Artemis™ appears here only where an Apache ActiveMQ® advisory names it. ## Apache ActiveMQ® vulnerability reference table The CVEs below are the security vulnerabilities most likely to matter in a production estate: remote code execution, authentication failures, unauthenticated denial of service, and anything exploited in the wild. Newest first. **CVE****CVSS 3.1****What it is****Auth needed****Affected****First fixed in****Exploited?**[CVE-2026-49157](https://nvd.nist.gov/vuln/detail/cve-2026-49157)8.8 (secondary)Non-admin web users keep Jolokia broker-management rights by defaultYes, any web userbefore 5.19.7; 6.0.0 before 6.2.65.19.7, 6.2.6No known2026 roundup (soon)[CVE-2026-45505](https://nvd.nist.gov/vuln/detail/cve-2026-45505)8.8 (secondary)Jolokia addNetworkConnector discovery-wrapper bypass of the 34197 fix, leading to RCEYesbefore 5.19.7; 6.0.0 before 6.2.65.19.7, 6.2.6No knownJolokia (soon)CVE-2026-425888.1 (secondary)Jolokia masterslave discovery URI loads a remote Spring XML config, leading to RCEYesbefore 5.19.7; 6.0.0 through 6.2.55.19.7, 6.2.6No knownJolokia (soon)CVE-2026-410448.8 (secondary; a second scorer rates 7.2)Web console broker-name validation bypass loads a remote Spring XML config, leading to RCEYesbefore 5.19.6; 6.0.0 before 6.2.55.19.6, 6.2.5No known2026 roundup (soon)CVE-2026-404668.8 (secondary)HTTP discovery second-stage URI bypass of the 34197 fix, leading to RCEYesbefore 5.19.6; 6.0.0 before 6.2.55.19.6, 6.2.5No knownJolokia (soon)CVE-2026-341978.8 (secondary)Jolokia addNetworkConnector crafted discovery URI loads a remote Spring XML config, leading to RCEYes; none on 6.0.0 to 6.1.1 via CVE-2024-32114before 5.19.4; 6.0.0 before 6.2.35.19.4, 6.2.3 (superseded by CVE-2026-40466, -45505 and -42588)CISA KEV, added 16 Apr 2026CISA KEV alert (soon)CVE-2025-661688.8 NIST; 5.4 ApacheMQTT Remaining Length field not validated; payload misparsed as packetsYesbefore 5.19.2; 6.0.0 before 6.1.9; 6.2.0 before 6.2.15.19.2, 6.1.9, 6.2.1 (6.x: use 6.2.4+, see CVE-2026-40046)No known2026 roundup (soon)CVE-2025-545399.8 (secondary).NET NMS AMQP client deserialization: a malicious broker achieves RCE on the clientClient-sideNMS AMQP Client through 2.3.02.4.0No known.NET clients (soon)CVE-2025-275337.5 NISTOpenWire unmarshaller does not check buffer length, allowing memory-exhaustion DoSNot stated; exposed when mutual TLS is off5.16.0 before 5.16.8; 5.17.0 before 5.17.7; 5.18.0 before 5.18.7; 6.0.0 before 6.1.65.16.8, 5.17.7, 5.18.7, 5.19.0, 6.1.6No knownOpenWire DoS (soon)CVE-2025-299539.8 (secondary); Apache rates it Moderate.NET NMS OpenWire client deserialization allowlist bypassClient-sideNMS OpenWire Client before 2.1.12.1.1No known.NET clients (soon)CVE-2024-321148.8 NIST; 8.5 Apache6.x default config leaves Jolokia and the REST API unauthenticatedNone (that is the flaw)6.0.0 before 6.1.26.1.2Enables unauthenticated CVE-2026-34197Jolokia (soon)CVE-2023-466049.8 NIST; 10.0 secondaryOpenWire unmarshaller deserialization, leading to RCE on broker or clientNonebefore 5.15.16; 5.16.0 before 5.16.7; 5.17.0 before 5.17.6; 5.18.0 before 5.18.3; also the Apache ActiveMQ® Legacy OpenWire Module5.15.16, 5.16.7, 5.17.6, 5.18.3CISA KEV, added 2 Nov 2023; DripDropper campaign, Aug 2025DripDropper (soon)CVE-2022-416788.8 NISTAuthenticated Jolokia call abuses the FlightRecorder MBean to write a JSP, leading to RCEYesbefore 5.16.6; 5.17.0 before 5.17.45.16.6, 5.17.4, 5.18.0, 6.0.0No knownJolokia (soon)CVE-2021-261177.5 NISTLDAP login module with anonymous bind skips the password checkA valid username onlybefore 5.15.14 and 5.16.1; Apache Artemis™ before 2.16.05.15.14, 5.16.1; Apache Artemis™ 2.16.0No knownLDAP bypass (soon) “Secondary” means a score on the NVD record from a scorer other than NIST or Apache. “No known” means the CVE is not in the CISA KEV catalog and we found no credible exploitation report. Full advisory text: [Apache ActiveMQ® security advisories](https://www.meshiq.com/blog/activemq-upgrade-patching-strategy/). ## ****Not sure which of these rows apply to you?**** Most estates run several Apache ActiveMQ® versions at once. Our engineers map each broker to the CVEs that affect it and the shortest upgrade path to close them. [************Get a CVE exposure review************](https://www.meshiq.com/activemq-support/cve/) ## The 2026 wave: 25 Apache ActiveMQ® Classic security vulnerabilities Apache’s advisory page lists 25 Apache ActiveMQ® Classic CVEs with 2026 IDs. They fall into five groups: - **Remote code execution (5)**: CVE-2026-34197 and four follow-ups that reach the same outcome by another route. - **Unauthenticated or protocol-level denial of service (7)**: OpenWire, STOMP, AMQP and TLS 1.3 handling that lets a client exhaust broker memory. - **Authorization and default permissions (6)**: web users and clients who can do more than their role should allow. - **Web console XSS and header injection (3)**. - **Other (4)**: LDAP network connector abuse, durable subscription disclosure, an MQTT fix missed on 6.x, and classpath path traversal. ## Complete 2026 Apache ActiveMQ® CVE list **CVE****Issue****Type****Auth needed****Fixed in (5.19.x / 6.x)****CVSS 3.1 (secondary)**CVE-2026-74761Client can spoof clientId when removing a durable subscriptionAuthorizationYes5.19.11 / 6.3.27.5CVE-2026-61487Authorization bypass via temporary composite destinationsAuthorizationYes5.19.9 / 6.2.8, 6.3.06.5CVE-2026-59878AMQP NIO negative frame size bypassDoSNo5.19.9 / 6.2.8, 6.3.07.5CVE-2026-54475Temporary destination ownership takeoverAuthorizationNot stated5.19.8 by version range\* / 6.2.77.5CVE-2026-53917Unbounded memory in OpenWire property unmarshallingDoSYes5.19.8 / 6.2.77.5CVE-2026-53916Unbounded header buffer in STOMP NIO codecDoSNo5.19.8 / 6.2.77.5CVE-2026-52760Stored XSS in the web consoleXSSYes (producer)5.19.8 / 6.2.76.1CVE-2026-50750Pre-auth OpenWire DoS introduced by the CVE-2026-49270 fixDoSNo5.19.8 by version range\* / 6.2.77.5CVE-2026-50734Pre-auth OpenWire allocation during wire-format negotiationDoSNo5.19.8 / 6.2.77.5CVE-2026-49877Authenticated web users keep admin console access by defaultAuthorizationYes5.19.8 / 6.2.78.1CVE-2026-49434LdapNetworkConnector instantiates denied transportsOtherWrite access to LDAP entries5.19.8 / 6.2.77.5CVE-2026-49432STOMP negative content-lengthDoSNo5.19.8 / 6.2.77.5CVE-2026-49270Durable subscription disclosure via crafted BrokerInfoOtherNo5.19.7 / 6.2.65.9CVE-2026-49157Non-admin web users keep Jolokia management rightsAuthorizationYes5.19.7 / 6.2.68.8CVE-2026-46605Incomplete authorization on destination removalAuthorizationYes5.19.7 / 6.2.64.3CVE-2026-45505Jolokia discovery-wrapper bypassRCEYes5.19.7 / 6.2.68.8CVE-2026-42588Jolokia masterslave discovery RCERCEYes5.19.7 / 6.2.68.1CVE-2026-42253HTTP response header injection via JMS propertiesInjectionNot stated5.19.7 / 6.2.66.1 (NIST)CVE-2026-41044Web console broker-name RCERCEYes5.19.6 / 6.2.58.8CVE-2026-41043Web console XSS when browsing queuesXSSYes5.19.6 / 6.2.56.5CVE-2026-40466HTTP discovery bypass of the 34197 fixRCEYes5.19.6 / 6.2.58.8CVE-2026-40046MQTT length fix for CVE-2025-66168 missing on 6.xOtherNot stated5.19.2 / 6.2.47.5CVE-2026-39304TLS 1.3 KeyUpdate handling exhausts memoryDoSNot stated5.19.5 / 6.2.47.5CVE-2026-34197Jolokia addNetworkConnector RCERCEYes5.19.4 / 6.2.38.8 (KEV)CVE-2026-33227Classpath path traversal via user-supplied keyOtherYes5.19.4 / 6.2.34.3\*The advisory lists 5.19.x as affected before 5.19.8 but names only a 6.x fix. ## **Apache ActiveMQ® latest version: which release fixes every CVE?** As of 30 September 2026, Apache ActiveMQ® 5.19.11 and 6.3.2 are the latest versions and the only releases Apache names as fixing every 2026 Apache ActiveMQ® Classic advisory. CVE-2026-74761 is fixed only in those two. Apache’s download page marks only the 5.19.x and 6.3.x lines as Active. The 6.2.x, 6.1.x, 6.0.x and 5.18.x lines are Inactive, which Apache defines as end-of-life with no further updates. If you are on any of them, the fix path is an upgrade, not a patch. We’ll cover how to sequence that safely in our [Upgrade & Patching Strategy guide](https://www.meshiq.com/blog/activemq-upgrade-patching-strategy/), and the wider Apache ActiveMQ® Classic lifecycle question in Apache ActiveMQ® Classic EOL: What Enterprises Need to Know. ## Three patterns behind most Apache ActiveMQ® RCE and exploit risk **Jolokia is the recurring RCE path.** Seven advisories in this index run through it, from CVE-2022-41678 to CVE-2026-34197 and the follow-ups that reopened it. **Exposed wire protocols invite pre-auth attacks.** CVE-2023-46604 and most of the 2026 DoS flaws need nothing more than a reachable OpenWire, STOMP or AMQP port. Our upcoming breakdown of CVE-2025-27533 covers why mutual TLS changes that picture. **Defaults do the damage.** CVE-2024-32114, CVE-2026-49157, CVE-2026-49877 and CVE-2021-26117 are all configuration defaults, not code bugs an attacker has to find. We’ll cover the LDAP case in Don’t Bind Anonymous. Our [Apache ActiveMQ® Security Hardening Guide](https://www.meshiq.com/blog/activemq-security-hardening-guide/) already covers the controls behind all three patterns: TLS on every transport, JAAS and LDAP authentication, web console and Jolokia restrictions, and network isolation. ## ****Stuck on an Inactive line?**** Moving from 5.18 or 6.2 to a supported release touches configs, clients and HA topology. Our Apache ActiveMQ® engineers plan and run the upgrade with you. [************Talk to an Apache ActiveMQ® expert************](https://www.meshiq.com/solutions/apache-activemq/enterprise-support/) ## Deep dives in this series Each major Apache ActiveMQ® vulnerability gets its own breakdown with exploitation detail, detection guidance and a remediation plan. - **Security Hardening Guide.** Layer-by-layer controls for Apache ActiveMQ® Classic and Apache Artemis™. [Full breakdown →](https://www.meshiq.com/blog/activemq-security-hardening-guide/) - **CVE-2023-46604 and the DripDropper campaign.** How attackers patched brokers themselves to lock out rivals. Coming soon. - **CISA KEV alert: CVE-2026-34197.** What the federal deadline means for everyone else. Coming soon. - **The Jolokia Problem.** Three CVEs, one attack surface, and the 2026 follow-ups. Coming soon. - **.NET NMS client CVEs.** When the broker attacks the client. Coming soon. - **State of Apache ActiveMQ® Security in 2026.** The full 2026 wave and what it signals for 2027. Coming soon. - **CVE-2025-27533.** OpenWire memory DoS and why mutual TLS matters. Coming soon. - **Don’t Bind Anonymous.** The LDAP authentication bypass in inherited configs. Coming soon. ## How we maintain this page We review this index every quarter and within 24 hours of a new Apache ActiveMQ® advisory. Every figure comes from the [Apache advisory files](https://activemq.apache.org/components/classic/security), the matching NVD record, and the [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Exploitation reports are cited only from primary research, such as [Horizon3.ai on CVE-2026-34197](https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/) and [Red Canary’s DripDropper analysis](https://www.zscaler.com/blogs/cybersecurity-best-practices/dripdropper-linux-malware). Spot an error? Tell us and we’ll correct it. #### **Close every row in this table** A CVE index tells you what is wrong. Closing it across dozens of brokers, client libraries and Inactive version lines is the harder part. meshIQ’s Apache ActiveMQ® engineers assess your exposure against this table, plan the upgrade to a supported line, and stay on call when the next advisory lands. Get [enterprise Apache ActiveMQ® support →](https://www.meshiq.com/solutions/apache-activemq/enterprise-support/) ## Frequently asked questions **Which Apache ActiveMQ® version fixes all known CVEs?** As of 30 September 2026, Apache ActiveMQ® 5.19.11 and 6.3.2 are the latest versions and the only releases Apache names as fixing every 2026 Apache ActiveMQ® Classic advisory. The 6.2.x, 6.1.x, 6.0.x and 5.18.x lines are marked Inactive on Apache’s download page and no longer receive updates. **What is the most critical Apache ActiveMQ® CVE?** CVE-2023-46604, an unauthenticated remote code execution (RCE) vulnerability in the OpenWire protocol. NIST scores it 9.8 and it is also widely cited at 10.0. It has been in the CISA Known Exploited Vulnerabilities catalog since 2 November 2023 and was still being exploited in August 2025. **Is CVE-2026-34197 being exploited?** Yes. CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog on 16 April 2026, with a federal remediation deadline of 30 April 2026. The exploit requires authentication, but on Apache ActiveMQ® 6.0.0 to 6.1.1 the Jolokia endpoint is unauthenticated by default (CVE-2024-32114), which makes it unauthenticated there. **Does CVE-2023-46604 affect Apache Artemis™?** No. The Apache advisory and the NVD record list only Apache ActiveMQ® (Classic) and the Apache ActiveMQ® Legacy OpenWire Module. Apache Artemis™ is now a separate Apache project with its own security advisories at artemis.apache.org. **Why does Jolokia keep appearing in Apache ActiveMQ® CVEs?** Jolokia exposes the broker’s JMX management operations over HTTP. At least seven Apache ActiveMQ® Classic advisories since 2023 run through it, including CVE-2022-41678, CVE-2024-32114, CVE-2026-34197 and two published bypasses of its fix. Restricting or disabling Jolokia removes the largest share of the Apache ActiveMQ® RCE surface.