What is the CVSS score of CVE-2026-45505?

CVE-2026-45505 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-45505?

Yes, a patch is available for CVE-2026-45505. Update the affected software to the latest version immediately.

Apache ActiveMQ CVE-2026-45505

EUVD-2026-33576 HIGH

Improper Input Validation (CWE-20)

2026-06-01 security@apache.org

GHSA-v853-w46p-fv2h

Java RCE Apache Activemq Activemq Broker Red Hat

8.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 8.8

Analysis Generated

Jun 01, 2026 - 15:23 vuln.today

CVSS changed

Jun 01, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

Jun 01, 2026 - 09:16 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.apache.activemq:activemq-all (3 direct, 3 indirect)
21 maven packages depend on org.apache.activemq:activemq-broker (14 direct, 7 indirect)

Ecosystem-wide dependent count for version 6.0.0 and other introduced versions.

DescriptionCVE.org

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... incorrectly pass validation allowing bypass of fix in CVE-2026-34197.

Original description from CVE-2026-34197.

Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

AnalysisAI

Remote code execution in Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ (versions before 5.19.7 and 6.0.0 before 6.2.6) allows authenticated attackers to bypass the CVE-2026-34197 fix using non-parenthesized discovery wrappers such as masterslave:vm://... and static:vm://..., which incorrectly pass validation and trigger the VM transport's brokerConfig parameter to load a remote Spring XML application context. The flaw abuses the Jolokia JMX-HTTP bridge at /api/jolokia/ to invoke BrokerService.addNetworkConnector/addConnector MBean operations, resulting in arbitrary code execution on the broker JVM. EPSS is low at 0.06% (19th percentile) and no public exploit identified at time of analysis, but the patch bypass nature and prior in-the-wild interest in ActiveMQ RCE chains warrant urgent patching.

Technical ContextAI

Apache ActiveMQ is a widely deployed open-source JMS message broker written in Java. The vulnerability sits at the intersection of three components: (1) the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the web console, whose default access policy permits exec operations on all org.apache.activemq:* MBeans; (2) the VM transport's discovery URI parser, which accepts composite/wrapper schemes; and (3) Spring's ResourceXmlApplicationContext, which eagerly instantiates singleton beans (including ones invoking Runtime.exec via factory methods) before BrokerService validates the configuration. CVE-2026-34197 attempted to validate discovery URIs to block remote Spring XML loading, but the regex/parser did not account for non-parenthesized wrapper forms like masterslave:vm://a,b and static:vm://a, which slip through validation while still resolving to an attacker-controlled brokerConfig. The root cause class is CWE-20 (Improper Input Validation) compounded by CWE-94 (Code Injection) via unsafe Spring XML bean instantiation.

RemediationAI

Vendor-released patch: upgrade to Apache ActiveMQ 5.19.7 (for the 5.x line) or 6.2.6 (for the 6.x line) per the Apache announcement at https://lists.apache.org/thread/7n97nddyw96w6ykldjv1h40jx86xdo0w. Because this is a bypass of CVE-2026-34197, the earlier patch is insufficient and must be replaced. If immediate upgrade is not feasible, restrict access to the /api/jolokia/ endpoint on the web console via reverse-proxy ACLs or by disabling the Jolokia agent in jetty.xml (side effect: breaks JMX-over-HTTP monitoring and any tooling depending on it); harden the Jolokia access policy (jolokia-access.xml) to deny exec operations on org.apache.activemq:type=Broker MBeans, particularly addNetworkConnector and addConnector (side effect: prevents legitimate dynamic connector management); rotate and strengthen ActiveMQ console/JMX credentials to eliminate weak or default authentication; and ensure the web console is not exposed to untrusted networks. Network egress filtering from broker hosts can also limit the attacker's ability to host the malicious Spring XML, but should not be relied on as primary control.