Critical Apache ActiveMQ Flaws Allow Remote Code Execution
Summary
CERT-Bund issued advisory WID-SEC-2026-1258 disclosing multiple critical vulnerabilities in Apache ActiveMQ message broker software affecting versions prior to 5.19.6 and 6.2.5 across UNIX, Windows, and other platforms. The vulnerabilities carry a CVSS Base Score of 8.8 (high) and Temporal Score of 7.7 (high), with remote attack capability confirmed. A remote, authenticated attacker can exploit these flaws to execute arbitrary code or conduct cross-site scripting attacks. Mitigation measures are available, and affected organizations are advised to patch to the latest versions.
“Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.”
Organizations running Apache ActiveMQ should immediately inventory all deployments across UNIX, Windows, and other platforms and verify which versions are in use. Given the CVSS 8.8 score and confirmed remote attack capability, affected deployments should be patched to versions 5.19.6 or 6.2.5 as available from Apache. Where immediate patching is not feasible, organizations should assess whether network access to ActiveMQ management interfaces can be restricted as a compensating control. This advisory likely affects organizations across multiple sectors using Apache ActiveMQ for enterprise messaging infrastructure.
About this source
CERT-Bund is the German federal cybersecurity agency's incident response team, run by the BSI. Their advisory feed publishes vulnerability disclosures and active exploitation warnings for software in widespread enterprise use: VPN appliances, email servers, file transfer products, ERP systems, browsers, hypervisors. Around 280 advisories a month, each with a CVSS score, affected versions, and remediation guidance. The advisories are written in German but cover the same vulnerabilities that show up in CISA, NCSC-UK, and JPCERT bulletins, often hours earlier. Watch this if you patch enterprise software, run a SOC, or write detection rules. GovPing publishes each advisory with the affected vendor, CVSS score, and original CERT-Bund link.
What changed
CERT-Bund disclosed multiple critical security vulnerabilities in Apache ActiveMQ message broker software across all supported versions prior to 5.19.6 and 6.2.5. The vulnerabilities affect Apache ActiveMQ Broker, ActiveMQ All, ActiveMQ, and ActiveMQ Web variants running on UNIX, Windows, and other operating systems. The CVSS Base Score of 8.8 indicates high severity with remote attack capability. Organizations running any affected version of Apache ActiveMQ should immediately identify their deployments and apply available patches. Since this is a message broker commonly used in enterprise IT infrastructure, patching priority should be high given the potential for remote code execution by authenticated attackers.
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1258] Apache ActiveMQ: Mehrere Schwachstellen CVSS Base Score 8.8 (hoch) CVSS Temporal Score 7.7 (hoch) Remoteangriff ja Datum 23.04.2026 Stand 24.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Sonstiges
- UNIX
- Windows
Produktbeschreibung
Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.
Produkte
23.04.2026
- Apache ActiveMQ Broker <5.19.6
Apache ActiveMQ Broker <6.2.5
Apache ActiveMQ All <6.2.5
Apache ActiveMQ All <5.19.6
Apache ActiveMQ <5.19.6
Apache ActiveMQ <6.2.5
Apache ActiveMQ Web <6.2.5
Apache ActiveMQ Web <5.19.6
Angriff
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.