PT-2026-53839 · Apache · Activemq

Add Content · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-49434

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.8 Apache ActiveMQ Broker versions 6.0.0 through 6.2.6 Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ All versions prior to 5.19.8 Apache ActiveMQ All versions 6.0.0 through 6.2.6

Description Improper input validation allows an attacker with permissions to publish or modify entries in LDAP that match the configured searchBase and searchFilter to instantiate denied transports within the broker JVM. This capability can be leveraged to fetch a URL controlled by the attacker and spawn a second BrokerService inside the same JVM.

Recommendations Upgrade Apache ActiveMQ Broker to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ All to version 5.19.8 or 6.2.7.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-49434

Affected Products

Activemq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49434 · Security Note
• https://lists.apache.org/thread/hcjh7kdk4l85tb9ksmvcnkhso1ngj50o · Vendor Advisory
• https://twitter.com/CVEnew/status/2071926688167145880 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/29/8 · Note