What is the CVSS score of CVE-2026-54475?

CVE-2026-54475 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache ActiveMQ are affected by CVE-2026-54475?

Apache ActiveMQ Classic versions before 5.19.8 and 6.0.0 before 6.2.7 contain an isolation flaw that allows connected clients to read messages from temporary destinations of other connections,…. A patch is available.

How to fix or mitigate CVE-2026-54475?

Within 24 hours: Audit deployed ActiveMQ versions and identify systems running affected versions (5.19.x before 5.19.8 or 6.0.x-6.1.x before 6.2.7). Within 7 days: Apply vendor-released patches to upgrade to ActiveMQ 5.19.8 or 6.2.7+; test in staging environment first. Within 30 days: Verify patch deployment across all ActiveMQ instances and review message routing policies to ensure applications do not rely on temporary destination isolation as a security boundary.

Apache ActiveMQ CVE-2026-54475

EUVD-2026-40276 HIGH

Missing Authorization (CWE-862)

2026-06-29

GHSA-mhp6-f224-j2c3

Apache Authentication Bypass Activemq Activemq Broker Red Hat

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

Network-reachable, low-complexity; PR:L because the attacker must hold a broker connection; impact is primarily disclosure of others' messages (C:H) plus lost delivery to the legitimate consumer (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 15:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 29, 2026 - 22:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 5 New Apache Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 29, 2026 News Critical Temporary Destination Hijacking in Apache ActiveMQ Classic - CVE-2026-54475 Jun 29, 2026

AnalysisAI

Unauthorized message consumption in Apache ActiveMQ Classic lets a connected client read from temporary destinations belonging to a different connection, breaking the per-connection isolation that applications rely on. The root cause is that the isolation check is enforced only client-side, so a malicious or rogue client can subscribe to and drain another connection's temporary queue/topic. It affects ActiveMQ (Broker/All/Classic) before 5.19.8 and 6.0.0 before 6.2.7; there is no public exploit identified at time of analysis, and it is not in CISA KEV.

Technical ContextAI

Apache ActiveMQ Classic is a widely used JMS message broker. 'Temporary destinations' are short-lived queues/topics scoped to the connection that created them - commonly used for request/reply patterns where a client publishes a request and expects the reply on its own private temporary destination. The security model assumes only the creating connection can consume from that destination. CWE-862 (Missing Authorization) is the precise root cause here: the broker fails to authoritatively enforce the ownership/isolation check server-side, instead trusting a client-side check. Because the trust boundary is misplaced, a second connection that references the same temporary destination can bypass the intended restriction. The affected components span the Broker, the 'All' distribution, and the core ActiveMQ Classic packaging.

RemediationAI

Vendor-released patch: upgrade to 6.2.7 on the 6.x line, or to 5.19.8 on the 5.x line, which add the missing server-side authorization check for temporary destinations (advisory: https://activemq.apache.org/ and https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys). Where immediate upgrade is not possible, reduce exposure by enabling and enforcing broker authentication and authorization so only trusted clients can open connections, and apply ActiveMQ authorization plugin policies that restrict who may create and consume from destinations - note this does not fully close the per-connection isolation gap and can break applications that rely on anonymous access. Additionally, restrict network access to broker transport ports (e.g. 61616/OpenWire, and any STOMP/AMQP/MQTT connectors) to known application hosts via firewalling, accepting that this limits legitimate remote producers/consumers, and avoid running shared multi-tenant brokers for sensitive request/reply workloads until patched.