PT-2026-34867 · Apache · Activemq

Jsjcw · Published 2026-04-23 · Updated 2026-05-03 · CVE-2026-41044

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.6 Apache ActiveMQ versions 6.0.0 through 6.2.4 Apache ActiveMQ Broker versions prior to 5.19.6 Apache ActiveMQ Broker versions 6.0.0 through 6.2.4 Apache ActiveMQ All versions prior to 5.19.6 Apache ActiveMQ All versions 6.0.0 through 6.2.4

Description Improper input validation and improper control of code generation allow an authenticated attacker to perform code injection. By using the admin web console, an attacker can create a malicious broker name that bypasses validation to include an xbean binding. This binding can be utilized by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to trigger VM transport creation referencing the malicious broker name, leading to the loading of a malicious Spring XML context file. Since ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM via bean factory methods such as Runtime.exec().

Recommendations Upgrade versions prior to 5.19.6 to 5.19.6. Upgrade versions 6.0.0 through 6.2.4 to 6.2.5.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

BDU:2026-06410

BIT-ACTIVEMQ-2026-41044

CVE-2026-41044

GHSA-MR6M-XJ7V-3CV3

OESA-2026-2124

OESA-2026-2125

OESA-2026-2126

OESA-2026-2127

Affected Products

Activemq

References · 32

• 🔥 https://github.com/mrillicit/CVE-2026-41044 · Exploit
• https://osv.dev/vulnerability/OESA-2026-2126 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-activemq-2026-41044 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mr6m-xj7v-3cv3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41044 · Security Note
• https://ubuntu.com/security/CVE-2026-41044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40046 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41044 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39304 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40466 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41044 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2125 · Vendor Advisory