What’s Vulnerable › Products

Apache Activemq Broker vulnerabilities

15 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your Apache Activemq Broker version is affected

Exploited Apache Activemq Broker vulnerabilities

• CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability

Latest Apache Activemq Broker vulnerabilities

• CVE-2026-74761 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId (CVSS 7.5)
• CVE-2026-61487 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations (CVSS 6.5)
• CVE-2026-54475 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover (CVSS 7.5)
• CVE-2026-53917 — Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling (CVSS 7.5)
• CVE-2026-50750 — Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 (CVSS 7.5)
• CVE-2026-49434 — Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker (CVSS 7.5)
• CVE-2026-49270 — Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) (CVSS 5.9)
• CVE-2026-46605 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal (CVSS 4.3)
• CVE-2026-45505 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass (CVSS 8.8)
• CVE-2026-42588 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector (CVSS 8.1)
• CVE-2026-41044 — Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia (CVSS 8.8)
• CVE-2026-40466 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI (CVSS 8.8)
• CVE-2026-39304 — Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM (CVSS 7.5)
• CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability (CVSS 8.8) — exploited
• CVE-2026-33227 — Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory (CVSS 4.3)