What is the CVSS score of EUVD-2026-74829?

EUVD-2026-74829 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache ActiveMQ are affected by EUVD-2026-74829?

Apache ActiveMQ versions before 5.19.11 and 6.3.2 contain an authentication flaw allowing legitimate broker clients to manipulate durable subscription removal requests and delete subscriptions owned…. A patch is available.

How to fix or mitigate EUVD-2026-74829?

Within 24 hours, identify all Apache ActiveMQ deployments and document which versions are in use (particularly 5.x pre-5.19.11 and 6.x pre-6.3.2). Within 7 days, plan and execute patching across development and staging environments, applying vendor patches to ActiveMQ 5.19.11 or 6.3.2 depending on your deployed version. Complete production patching within 30 days, prioritizing systems that rely on durable subscriptions for critical workflows; coordinate maintenance windows with application teams to minimize service interruption.

Apache ActiveMQ EUVD-2026-74829

| CVE-2026-74761 HIGH

Improper Input Validation (CWE-20)

2026-09-08

GHSA-hx9m-72qj-2q46

Apache

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Description explicitly requires an authenticated client (PR:L minimum); no confidentiality or availability impact per the attack mechanics; integrity is high via subscription deletion.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 10, 2026 - 18:40 vuln.today

tag: Information Disclosure removed

Analysis Updated

Sep 10, 2026 - 18:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 10, 2026 - 18:23 vuln.today

cvss_changed

CVSS changed

Sep 10, 2026 - 18:23 NVD

7.5 (HIGH)

Patch available

Sep 09, 2026 - 12:03 EUVD

Analysis Generated

Sep 08, 2026 - 16:16 vuln.today

CVE Published

Sep 08, 2026 - 15:48 oss-security

MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Improper input validation in the TopicRegion component of Apache ActiveMQ allows an authenticated broker client to forge the clientId field in a durable subscription removal request, causing the broker to delete a subscription belonging to a different, legitimate client. All ActiveMQ deployments in the 5.x line before 5.19.11 and the 6.x line before 6.3.2 are affected across all platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires at minimum a valid, authenticated broker session - the attacker must hold a username and password (or client certificate, depending on broker security configuration) accepted by the ActiveMQ broker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) assigns PR:N, which directly conflicts with the description's explicit statement that 'an authenticated client' performs the attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache ActiveMQ 6.3.2 or 5.19.11, which contain the vendor-released fix per the advisory at https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz. … Detailed patch versions, workarounds, and compensating controls in full report.