PT-2026-45381 · Apache · Activemq

Leon Johnson · CVE-2026-49157 · Published 2026-06-01 · Updated 2026-06-24

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5

Description Incorrect default permissions in Jolokia authorization settings allow authenticated low-privilege web-login accounts to access operations intended for administrators. This enables non-admin users to execute broker management operations, such as addQueue() and removeQueue().

Recommendations Update versions prior to 5.19.7 to version 5.19.7. Update versions 6.0.0 through 6.2.5 to version 6.2.6.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BIT-ACTIVEMQ-2026-49157

CVE-2026-49157

GHSA-99QX-5QQR-4J95

OESA-2026-2723

OESA-2026-2724

OESA-2026-2725

Affected Products

Activemq

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49157.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-49157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-49157 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45505 · Security Note
• https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49270 · Security Note
• https://osv.dev/vulnerability/BIT-activemq-2026-49157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42588 · Security Note
• https://ubuntu.com/security/CVE-2026-49157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49157 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-49157 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-49157 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99qx-5qqr-4j95 · Vendor Advisory