Apache ActiveMQ CVE-2026-49157

Exploitation requires the attacker to possess valid credentials for any non-admin web-login account on the ActiveMQ web console (PR:L in the CVSS vector), and network reachability to the Jolokia management endpoint exposed by the broker. The vulnerable configuration is the default Jolokia authorization policy shipped with affected versions, so no custom configuration is needed on the victim side - out-of-the-box deployments of ActiveMQ before 5.19.7 or 6.0.0-6.2.5 are exposed. Exploitation is limited by the need for an authenticated low-privilege account (no anonymous attack path), and by whether the Jolokia endpoint is reachable from the attacker's network position; deployments where the web console is restricted to internal admin networks materially reduce real-world exposure.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a remotely reachable, low-complexity flaw exploitable by any authenticated low-privilege user with high impact across all three pillars. However, EPSS is exceptionally low at 0.01% (3rd percentile) and the CVE is not listed in CISA KEV, indicating no observed in-the-wild exploitation. The disparity is consistent with the nature of the issue: it requires a valid (even unprivileged) web-login account, which limits opportunistic mass exploitation but is highly impactful in environments where multi-tenant or partner accounts exist on the broker. No public exploit identified at time of analysis. Realistic priority is moderate-to-high for any deployment that grants web console accounts to non-administrators; low for brokers where every user is already trusted as administrator.

An attacker who has obtained or been issued a low-privilege ActiveMQ web-console account (for example, a developer, a partner integration user, or via credential reuse) authenticates and issues a Jolokia HTTP POST to the broker's management endpoint invoking operations such as addQueue or removeQueue. Because the default policy authorizes these operations for non-admin web-login users, the broker executes them, allowing the attacker to create rogue queues for staging messages, delete production queues to cause denial of service, or otherwise tamper with broker state. No public exploit identified at time of analysis, but the operations are well-documented Jolokia/JMX calls that are trivial to reproduce with curl.