PT-2026-34871 · Apache · Apache Activemq Web+1

Khaled Alshammri · Published 2026-04-24 · Updated 2026-05-03 · CVE-2026-41043

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.6 Apache ActiveMQ versions 6.0.0 through 6.2.4 Apache ActiveMQ Web versions prior to 5.19.6 Apache ActiveMQ Web versions 6.0.0 through 6.2.4

Description An authenticated attacker can display malicious content when browsing queues in the web console. This is achieved by overriding the content type to HTML instead of XML and injecting HTML into a JMS selector field, leading to Cross-Site Scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation or escaping.

Recommendations Upgrade to version 5.19.6. Upgrade to version 6.2.5.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-915

Related Identifiers

BIT-ACTIVEMQ-2026-41043

CVE-2026-41043

GHSA-2JP3-2923-9H52

OESA-2026-2124

OESA-2026-2125

OESA-2026-2126

OESA-2026-2127

Affected Products

Apache Activemq

Apache Activemq Web

References · 28

• https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34197 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2125 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41043 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41043 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2jp3-2923-9h52 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41043 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2127 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33227 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40046 · Security Note
• https://osv.dev/vulnerability/BIT-activemq-2026-41043 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2126 · Vendor Advisory