What is the CVSS score of EUVD-2026-40283?

EUVD-2026-40283 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache ActiveMQ are affected by EUVD-2026-40283?

Apache ActiveMQ versions through 5.19.7 and 6.0.0 through 6.2.6 contain a privilege escalation vulnerability allowing authenticated Web Console users to gain unauthorized administrative access.. A patch is available.

How to fix or mitigate EUVD-2026-40283?

Within 24 hours: Identify all Apache ActiveMQ instances and document deployed versions. Within 7 days: Upgrade to version 5.19.8 or 6.2.7 (depending on deployment version), coordinating with operations teams to minimize service disruption. Within 30 days: Audit Web Console access logs for unauthorized administrative activities and review user role assignments to ensure proper privilege boundaries.

Apache ActiveMQ EUVD-2026-40283

| CVE-2026-49877 HIGH

Improper Authorization (CWE-285)

2026-06-30 apache

GHSA-f892-4h9f-j7g9

Authentication Bypass Apache Apache Activemq Apache Software Foundation

8.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable Web Console (AV:N) abused by any logged-in low-privilege user (PR:L) with no interaction; admin access yields high confidentiality and integrity impact but no availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 13:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 13:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 13:22 NVD

8.1 (HIGH)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 30, 2026 - 11:16 vuln.today

DescriptionCVE.org

Improper Authorization vulnerability in Apache ActiveMQ.

An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Articles & Coverage 1

News 5 New Apache Vulnerabilities - 5 High Severity, No Public POC Jul 01, 2026

AnalysisAI

Privilege escalation via improper authorization in Apache ActiveMQ before 5.19.8 and 6.0.0 before 6.2.7 lets an authenticated low-privilege Web Console user reach the administrative /admin/* paths that should be restricted to administrators. The flaw stems from default Jetty configuration that failed to scope those paths to admin roles, granting low-priv users administrative Web Console functionality. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Apache ActiveMQ is a widely used open-source JMS message broker; its Web Console is a management UI served over an embedded Jetty servlet container. The vulnerability is CWE-285 (Improper Authorization): the default Jetty security constraints did not bind the /admin/* URL space to the administrator role, so role-based access control was effectively not enforced on those paths. Any account that can authenticate to the Web Console (including a default low-privilege user) inherits access to administrative endpoints. The CPE cpe:2.3:a:apache_software_foundation:apache_activemq covers the broker product line affected by this misconfiguration in shipped defaults.

RemediationAI

Vendor-released patch: upgrade to Apache ActiveMQ 6.2.7 (for the 6.x line) or 5.19.8 (for older releases), which correct the Jetty path restrictions; see the Apache advisory at https://lists.apache.org/thread/w82vtc3q02j5ot94tnyy1197y3wb98hl. If immediate upgrade is not possible, restrict access to the Web Console at the network layer (firewall/reverse-proxy allowlist so only administrators reach it), and tighten the Jetty security constraints to explicitly require the admin role for /admin/* - note that hardening the constraints by hand risks misconfiguring legitimate admin access and should be validated against the patched configuration. As a further compensating control, minimize or remove low-privilege Web Console accounts and review who can authenticate to the console, accepting that this reduces self-service/monitoring access for non-admin users.