PT-2026-22725 · Eclipse · Eclipse Openmq

Camilo G + 1 · Published 2026-03-03 · Updated 2026-03-03 · CVE-2026-22886

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse OpenMQ (affected versions not specified)

Description Eclipse OpenMQ includes a TCP-based management service (imqbrokerd) that requires authentication by default. The product is shipped with a default administrative account (admin/admin) and does not enforce a mandatory password change upon first use. The server continues to accept the default password indefinitely after the initial successful login, without any warning or enforcement. An attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1393

CWE-1391

CWE-1392

Related Identifiers

CVE-2026-22886

Affected Products

Eclipse Openmq

References · 12

• https://gitlab.eclipse.org/security/cve-assignment/-/issues/85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22886 · Security Note
• https://twitter.com/AIengineerlife/status/2028849909819228207 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028775052196352003 · Twitter Post
• https://twitter.com/cyberbivash/status/2028773058308083893 · Twitter Post
• https://t.me/CVEtracker/46194 · Telegram Post
• https://twitter.com/CVEnew/status/2028774017235140843 · Twitter Post
• https://twitter.com/cyberbivash/status/2028765607827493077 · Twitter Post
• https://t.me/cveNotify/153896 · Telegram Post
• https://twitter.com/vuln_tracker/status/2028795663752847754 · Twitter Post
• https://twitter.com/CveFindCom/status/2028782851458511260 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028780104705614175 · Twitter Post