High WID-SEC-2026-1258 3 CVEs

Apache ActiveMQ: Mehrere Schwachstellen

Published Apr 23, 2026 · Updated Sep 13, 2026 · Revision 3 · de-DE

Vendor: Apache Vendor: IBM Product: ActiveMQ Product: Cognos Analytics Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.

Vulnerabilities 3

High 8.8

CVE-2026-40466 Scanner template

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an H…

Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven

Apr 24, 2026
High 8.8

CVE-2026-41044 Public exploit

Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker na…

Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven

Apr 24, 2026
Medium 6.5

CVE-2026-41043

Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to…

Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Web activemq Debian Ubuntu Maven

Apr 24, 2026

Revision history

2026-09-13 #3
Neue Updates von IBM aufgenommen
2026-04-26 #2
Referenz(en) aufgenommen: EUVD-2026-25412, EUVD-2026-25411
2026-04-23 #1
Initiale Fassung

References

Apache ActiveMQ Security Advisory vom 2026-04-23
https://activemq.apache.org/security-advisories.data/CVE-2026-40466-announcement.txt
Apache ActiveMQ Security Advisory vom 2026-04-23
https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt
Apache ActiveMQ Security Advisory vom 2026-04-23
https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt
IBM Security Bulletin 7287209 vom 2026-09-11
https://www.ibm.com/support/pages/node/7287209