What is the CVSS score of CVE-2026-49157?

CVE-2026-49157 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache ActiveMQ are affected by CVE-2026-49157?

Apache ActiveMQ versions before 5.19.7 and 6.0.0-6.2.5 contain a privilege escalation vulnerability (CVE-2026-49157, CVSS 8.8) allowing authenticated users to execute unauthorized administrative…. A patch is available.

How to fix or mitigate CVE-2026-49157?

Within 24 hours: Identify all ActiveMQ deployments running vulnerable versions (5.x before 5.19.7; 6.0.0 through 6.2.5). Within 7 days: Upgrade to vendor-patched versions (5.19.7 or later for 5.x line; 6.3.0 or later for 6.x line). Within 30 days: Review audit logs for unauthorized queue management or administrative operations initiated from standard user accounts during the vulnerability window.

Apache ActiveMQ CVE-2026-49157

EUVD-2026-33574 HIGH

Incorrect Default Permissions (CWE-276)

2026-06-01 security@apache.org

GHSA-99qx-5qqr-4j95

Privilege Escalation Apache Red Hat Activemq

8.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:23 vuln.today

CVSS changed

Jun 01, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

Jun 01, 2026 - 09:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 09:16 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

AnalysisAI

Privilege escalation in Apache ActiveMQ versions before 5.19.7 and 6.0.0 through 6.2.5 allows authenticated low-privilege web-login users to invoke administrative Jolokia operations such as addQueue and removeQueue due to overly permissive default authorization settings. The CVSS 8.8 score reflects high impact on confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.01% and no public exploit identified at time of analysis. The flaw effectively collapses the broker's privilege boundary between normal web users and administrators.

Technical ContextAI

Apache ActiveMQ is a widely deployed open-source message broker implementing JMS, AMQP, MQTT, and STOMP protocols. It exposes a management interface via Jolokia, a JMX-HTTP bridge that allows JMX MBean operations to be invoked over REST. The vulnerability is rooted in CWE-276 (Incorrect Default Permissions): the shipped Jolokia authorization policy did not properly restrict sensitive MBean operations (such as addQueue and removeQueue on broker management beans) to administrative roles, instead inheriting permissions that allowed any authenticated web-login user to invoke them. This is a configuration/policy defect in the access-control mapping rather than a memory-safety or injection bug.

RemediationAI

Vendor-released patch: upgrade to Apache ActiveMQ 6.2.6 (for the 6.x line) or 5.19.7 (for the 5.x line), which correct the default Jolokia authorization policy as described in the Apache advisory at https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8. Where immediate upgrade is not feasible, restrict the Jolokia endpoint by tightening jolokia-access.xml or the policy file to require an explicit admin role for management MBeans (notably addQueue, removeQueue, and similar broker operations), or front the Jolokia path with an authenticating reverse proxy that allows only admin users - the side effect is that legitimate non-admin monitoring queries through Jolokia will also be denied. As an additional control, audit existing low-privilege web-login accounts and remove any that are no longer needed, since exploitation requires a valid credential.