Apache ActiveMQ CVE-2026-111822

Requires the Apache ActiveMQ Runtime Config plugin to be in use for live authorization management. The abusing principal must (1) already be authenticated, (2) have previously held a write grant on the target destination, and (3) retain a connection opened BEFORE the administrator removed that write grant; on such a connection it can keep sending to the destination, including through a newly created anonymous producer. Limiting factors that reduce real-world risk: it does not grant access to anyone who was never authorized - fresh connections and newly created explicit producers are correctly denied; it only concerns write grants revoked at runtime while a session stays open; and it depends on the Runtime Config plugin being the ACL-management path. The input provides no CVSS vector, so the authentication level is taken from the vendor description ('an authenticated connection') rather than a confirmed PR metric.

Signal coverage is thin: no CVSS vector, no EPSS score, no CISA KEV entry, and no PoC or exploit reference accompany this CVE, and the aggregator Decision label is explicitly 'awaiting_data', so no quantitative exploitation probability can be stated. Severity rests on the vendor rating of 'important' and the described mechanism. The flaw is an authorization-invalidation bug, not a remote code path: exploitation presupposes a party that was already authenticated AND already held a write grant on the destination, keeping a connection open across the moment an administrator revokes that grant through the Runtime Config plugin. That makes this a privilege-retention / stale-ACL issue rather than a mass-exploitable network vulnerability - realistic abuse is by an insider or a previously-trusted (now-compromised or de-provisioned) client, not by an arbitrary external attacker. Note the input provides no CVSS vector, so authentication and attack-vector metrics cannot be confirmed from the data and are inferred from the vendor description only; this should be verified against the Apache advisory. Net: a legitimate but bounded authorization-enforcement defect - important for environments that rely on live ACL revocation via the Runtime Config plugin, but not an emergency given the narrow preconditions and absence of any exploitation or PoC signal.

A client that was granted write access to a destination keeps its ActiveMQ connection open while an administrator uses the Runtime Config plugin to revoke that principal's write grant. Because the cached authorization is not invalidated for the existing connection, the client continues sending messages to the destination - including through a newly opened anonymous producer - even though fresh connections and new explicit producers are correctly denied. No public exploit code is identified at time of analysis.