AC
Messaging
ActiveMQ
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 13High 31Medium 16Low 2
Watch
Add ActiveMQ to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-46604 RansomwareIn wildKEV | 9.8 | Oct 27 | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack Affected: 5.18.0 before 5.18.3; 5.17.0 before 5.17.6; 5.16.0 before 5.16.7; before 5.15.16 |
| CVE-2016-3088 In wildKEV | 9.8 | Jun 1 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request Affected: 5.0.0 before 5.14.0 |
| CVE-2026-34197 In wildKEV | 8.8 | Apr 7 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans Affected: before 5.19.4; 6.0.0 before 6.2.3 |
| CVE-2021-21345 | 9.9 | Mar 22 | XStream is vulnerable to a Remote Command Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21350 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21344 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21346 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21347 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2020-11998 | 9.8 | Sep 10 | A regression has been introduced in the commit preventing JMX re-bind Affected: 5.15.12 |
| CVE-2013-7285 | 9.8 | May 15 | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by… Affected: 5.15.8 |
| CVE-2014-3600 | 9.8 | Oct 27 | XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +12 more |
| CVE-2015-5254 | 9.8 | Jan 8 | Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +18 more |
| CVE-2021-21351 | 9.1 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21342 | 9.1 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2026-45505 | 8.8 | Jun 1 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2026-49157 | 8.8 | Jun 1 | Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2026-41044 | 8.8 | Apr 24 | Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia Affected: before 5.19.6; 6.0.0 before 6.2.5 |
| CVE-2026-40466 | 8.8 | Apr 24 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI Affected: before 5.19.6; 6.0.0 before 6.2.5 |
| CVE-2025-66168 | 8.8 | Mar 4 | WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases Affected: before 5.19.2; 6.0.0 through 6.1.8; 6.2.0 |
| CVE-2024-32114 | 8.8 | May 2 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located) Affected: 6.0.0 before 6.1.2 |
| CVE-2022-41678 | 8.8 | Nov 28 | Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet… Affected: before 5.16.6; 5.17.0 before 5.17.4 |
| CVE-2020-26217 | 8.8 | Nov 16 | Remote Code Execution in XStream Affected: before 5.15.14; 5.16.0 |
| CVE-2021-21349 | 8.6 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2026-49877 | 8.1 | Jun 30 | Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-42588 | 8.1 | Jun 1 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2026-74761 | 7.5 | Sep 9 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId Affected: 6.0.0 before 6.3.2; before 5.19.11 |
| CVE-2026-59878 | 7.5 | Jul 28 | Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS Affected: before 5.19.9; 6.0.0 before 6.2.8 |
| CVE-2026-49434 | 7.5 | Jun 30 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-49432 | 7.5 | Jun 30 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-50734 | 7.5 | Jun 30 | Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-50750 | 7.5 | Jun 30 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 Affected: 5.19.7 before 5.19.8; 6.2.6 before 6.2.7 |
| CVE-2026-53916 | 7.5 | Jun 30 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-53917 | 7.5 | Jun 30 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-54475 | 7.5 | Jun 30 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-39304 | 7.5 | Apr 10 | Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM Affected: before 5.19.4; 6.0.0 before 6.2.4 |
| CVE-2026-40046 | 7.5 | Apr 9 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated Affected: 6.0.0 before 6.2.4 |
| CVE-2025-27533 | 7.5 | May 7 | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Affected: 5.16.0 before 5.16.8; 5.17.0 before 5.17.7; 5.18.0 before 5.18.7; 6.0.0 before 6.1.6 |
| CVE-2021-21348 | 7.5 | Mar 22 | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21341 | 7.5 | Mar 22 | XStream can cause a Denial of Service Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21343 | 7.5 | Mar 22 | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-26117 | 7.5 | Jan 27 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server Affected: 5.15.0 before 5.15.14; 5.16.0 before 5.16.1 |
| CVE-2019-0222 | 7.5 | Mar 28 | In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive Affected: 5.0.0 through 5.15.8 |
| CVE-2014-3576 | 7.5 | Aug 14 | The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a… Affected: through 5.10.0 |
| CVE-2018-11775 | 7.4 | Sep 10 | TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using… Affected: before 5.15.6 |
| CVE-2026-61487 | 6.5 | Jul 28 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations Affected: before 5.19.9; 6.0.0 before 6.2.8 |
| CVE-2026-41043 | 6.5 | Apr 24 | Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues Affected: before 5.19.6; 6.0.0 before 6.2.5 |
| CVE-2026-52760 | 6.1 | Jun 30 | Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-42253 | 6.1 | Jun 1 | Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2020-13947 | 6.1 | Feb 8 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions… Affected: before 5.15.14; 5.16.0 before 5.16.1 |
| CVE-2020-1941 | 6.1 | May 14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue Affected: 5.0.0 through 5.15.11 |