CVE-2026-49157 Detail

Nvd.Nist • June 1, 2026

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities Discovered in Apache ActiveMQ Management Interfaces CVE-2026-34197, a high-severity remote code execution vulnerability, affects Apache ActiveMQ Classic due to unsafe exposure of the Jolokia HTTP/JMX management interface. Attackers can exploit this flaw to execute arbitrary code by interacting with privileged broker operations. Additionally, CVE-2026-45505 and CVE-2026-49157 reveal further weaknesses in input validation and default permissions, respectively, allowing unauthorized access to management operations. These vulnerabilities impact versions of ActiveMQ prior to 5.19.7 and from 6.0.0 before 6.2.6. The vulnerabilities have been publicly disclosed, with the first proof of concept available shortly after CVE-2026-34197's publication. Given the critical role of ActiveMQ in enterprise environments, immediate remediation is essential to mitigate risks to application availability and operational continuity. 3 sources 72

Extracted Entities

CVE-2026-49157 Detail

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Tools (1)