What is the CVSS score of EUVD-2026-40279?

EUVD-2026-40279 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache ActiveMQ are affected by EUVD-2026-40279?

Apache ActiveMQ Web Console contains a stored cross-site scripting vulnerability (CVE-2026-52760) that allows authenticated message producers to inject malicious code into queue message IDs, which…. A patch is available.

How to fix or mitigate EUVD-2026-40279?

Within 24 hours: inventory all ActiveMQ Web Console instances; audit and list all message producer accounts with active credentials. Within 7 days: restrict Web Console network access to administrative networks only (via firewall or VPN); deactivate unused producer accounts; enable detailed audit logging for Web Console access and producer activity. Within 30 days: monitor Apache ActiveMQ security advisories for CVE-2026-52760 patch release; prepare staging environment for patch testing; if operationally feasible, disable Web Console until vendor patch is available.

Apache ActiveMQ EUVD-2026-40279

| CVE-2026-52760 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-29

GHSA-j548-68g5-9j7x

XSS Apache Activemq Activemq Web

6.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Producer authentication requires PR:L; admin must browse queue so UI:R; XSS executes in admin browser changing scope S:C with limited session-level C and I impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 30, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 30, 2026 - 17:22 NVD

6.1 (HIGH) 6.1 (MEDIUM)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 29, 2026 - 22:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 3

News 5 New Apache Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 29, 2026

AnalysisAI

Stored cross-site scripting in Apache ActiveMQ Web Console allows an authenticated message producer to inject malicious JavaScript via a crafted JMS message ID, which executes in the browser of any administrator who browses the affected queue. The browse page renders message IDs without HTML sanitization, enabling privilege escalation from producer to administrator via session hijacking or credential theft. No public exploit identified at time of analysis and not listed in CISA KEV; rated moderate severity by Apache, consistent with the authentication prerequisite and required user interaction.

Technical ContextAI

The vulnerability resides in the queue browse page of the ActiveMQ Web Console, a Java-based administrative interface bundled with Apache ActiveMQ (org.apache.activemq:apache-activemq and org.apache.activemq:apache-web-console). JMS message IDs are application-level metadata fields that a connected producer controls at send time. The root cause is the absence of output encoding when the Web Console renders these IDs into HTML - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw. Because the malicious payload is stored in the broker's message store and replayed to every administrator who browses the queue, this is a persistent (stored) XSS rather than a reflected variant, amplifying the window of exploitation beyond a single request.

RemediationAI

Upgrade to Apache ActiveMQ 6.2.7 (for 6.x deployments) or 5.19.8 (for 5.x deployments), both released June 29, 2026 and confirmed as the official fixes by the Apache advisory at https://activemq.apache.org/. If an immediate upgrade is not possible, restrict access to the ActiveMQ Web Console to trusted internal networks or VPN-only segments - this limits the damage by ensuring only already-trusted administrators can trigger the payload. Additionally, consider disabling or firewalling the Web Console port (default 8161) entirely and using CLI tooling (activemq-cli or JMX) for queue inspection as a compensating control; note that disabling the console removes administrative visibility and may impact operational monitoring. Do not rely on network controls alone as a permanent fix, since authenticated insider producers still pose a risk within the trusted network perimeter.