IT administrators and organizations using Apache ActiveMQ are urged to proceed without delay in upgrading their installations, following the disclosure of three serious security vulnerabilities that could lead to denial of service (DoS), unauthorized access to data, and breach of critical management mechanisms.
The security issues, listed as CVE-2026-53917, CVE-2026-54475 and CVE-2026-49877, affect both the 5.x and the newer 6.x version series of Apache ActiveMQ. According to the information published, the vulnerabilities are located in key subsystems of the message broker and can, under certain circumstances, be exploited by authenticated users to perform attacks or gain privileges they should not have.
Apache ActiveMQ is a core component of many corporate infrastructures
Apache ActiveMQ is widely used as a messaging platform between applications, servers, and services in enterprise environments. Its reliability has made it particularly popular in enterprises, banks, telecommunications providers, government organizations, and cloud infrastructures, where uninterrupted communication between different systems is a critical operational factor.
See also: Adobe brings a second Patch Tuesday every month
Precisely because of its importance, any vulnerability in its operating mechanism can have widespread impacts, especially in production environments that serve a large number of applications simultaneously.
The first vulnerability can cause the broker to crash
The most serious of the three vulnerabilities concerns CVE-2026-53917, which is related to the way ActiveMQ processes OpenWire.
Specifically, an authenticated user can send specially crafted messages that include an excessively large amount of data in the message properties. Because the broker does not apply adequate controls on the size of this information, it attempts to allocate huge amounts of memory.
The result can be an Out of Memory, a service crash, and ultimately a Denial of Service (DoS) attack . In environments where multiple applications rely on the same broker, even a successful attack can disrupt critical business operations.
Isolation violation between connections
The second vulnerability, CVE-2026-54475, exposes a problem in the way ActiveMQ handles temporary destinations. Normally, in ActiveMQ Classic, temporary destinations are designed to be isolated to the connection that created them, so only that connection can consume messages from the temporary queue or topic. However, the researchers found that this checking was mainly done on the client side, not on the broker itself.
This means that different connections could, under certain conditions, gain access to messages intended for other users.
See also: Serious vulnerabilities in WatchGuard Firebox: Risk of firewall compromise
In infrastructures where multiple customers or different organizations share the same message broker, this issue could lead to the leakage of sensitive information or a violation of isolation between different services.
Elevated privileges via Web Console
The third vulnerability, CVE-2026-49877, concerns the ActiveMQ administration console. Experts found that the default configuration of Jetty allowed users with limited privileges to gain access to administration paths normally reserved for administrators.
Thus, a simple authenticated user could perform actions that affect the operation of the broker, modify security settings, or even use this access as a springboard for further attacks within the corporate network.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This is a particularly critical issue for organizations that have exposed the management console to internal or remote work environments.
Which versions are affected?
The vulnerabilities affect all versions of Apache ActiveMQ before 5.19.8, as well as versions from 6.0.0 up to and including 6.2.7.
The fixed versions incorporate significant security changes, such as strict size control in OpenWire property maps, confirmation of ownership of temporary destinations directly from the broker, and proper enforcement of access rights in the management console.
See also: CVE-2026-45659: SharePoint RCE bug in CISA KEV
Recommendations to administrators
Upgrading to versions 5.19.8 or 6.2.7 is the most effective solution and is recommended to be done immediately.
At the same time, security experts recommend restricting access to brokers and management consoles only from trusted networks, implementing strong authentication for all administrator accounts, and regularly reviewing user roles to avoid excessive privileges.
It is equally important to constantly monitor the broker for unusual memory consumption, unexpected reboots, or unexplained attempts to access the management console. In an era where attacks on corporate infrastructure are becoming increasingly sophisticated, timely implementation of security updates remains the most effective defense against modern cyber threats.
