What is the CVSS score of CVE-2026-61487?

CVE-2026-61487 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-61487?

Yes, a public proof-of-concept exploit is available for CVE-2026-61487. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-61487?

Yes, a patch is available for CVE-2026-61487. Update the affected software to the latest version immediately.

Apache ActiveMQ CVE-2026-61487

EUVD-2026-49847 MEDIUM

Improper Authorization (CWE-285)

2026-07-27

GHSA-xmcq-x3wj-p8v6

Authentication Bypass Apache Activemq Activemq Broker Activemq All

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network accessible, low complexity, requires low privileges, no user interaction, only integrity impact (unauthorized message injection).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 28, 2026 - 15:02 EUVD

Analysis Generated

Jul 27, 2026 - 18:15 vuln.today

CVE Published

Jul 27, 2026 - 17:30 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Authorization bypass in Apache ActiveMQ 5.x before 5.19.9 and 6.x before 6.2.8 allows authenticated low-privilege users to publish messages to any queue without proper write ACLs by abusing temporary composite destinations. This enables unauthorized message injection into restricted queues, potentially disrupting message integrity and business logic. No active exploitation or public exploit code has been identified.

Technical ContextAI

Apache ActiveMQ is a Java-based multi-protocol message broker implementing JMS. Composite destinations allow addressing multiple physical queues via a comma-separated name. Temporary destinations are typically used for request-reply patterns and are dynamically created by clients. The flaw lies in improper authorization checks (CWE-285) when a message is sent to a temporary composite destination: the broker incorrectly trusts the temporary flag and skips write ACL validation for the constituent queues, enabling low-privileged users to write to any destination. Affected Maven artifacts include org.apache.activemq:activemq-broker, org.apache.activemq:activemq-all, and org.apache.activemq:apache-activemq.

RemediationAI

Upgrade to Apache ActiveMQ 5.19.9, 6.2.8, or 6.3.0, which include the fix. No viable workaround exists for this authorization bypass if per-destination ACLs are essential; as an interim measure, administrators could disable temporary destination creation for untrusted users, but this may break legitimate client functionalities. Refer to the Apache ActiveMQ security page for patch downloads.