PT-2026-45369 · Apache · Activemq Web+1

4Ra1N + 4 · CVE-2026-42253 · Published 2026-06-01 · Updated 2026-06-24

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 Apache ActiveMQ Web versions prior to 5.19.7 Apache ActiveMQ Web versions 6.0.0 through 6.2.5

Description An improper neutralization of input during web page generation allows for Cross-site Scripting (XSS). The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without validation. This allows an attacker to overwrite and inject security headers by setting them on JMS messages returned by the servlet.

Recommendations Upgrade to version 5.19.7. Upgrade to version 6.2.6. As a temporary mitigation, disable the MessageServlet function.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ACTIVEMQ-2026-42253

CVE-2026-42253

GHSA-8WM6-6FQH-PHMC

OESA-2026-2723

OESA-2026-2724

OESA-2026-2725

Affected Products

Activemq

Activemq Web

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42253.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-42253 · Vendor Advisory
• https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45505 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42253 · Security Note
• https://osv.dev/vulnerability/BIT-activemq-2026-42253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46605 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-49157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-49270 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2725 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42253 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42253 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2723 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42253 · Security Note