Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache ActiveMQ

40 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-42588 Public exploit

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  • High 8.8
    CVE-2026-41044 Public exploit

    Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker na…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  • High 8.8
    CVE-2026-34197 Exploited Public exploit EPSS 98%

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
    KEV Apr 16, 2026
  • Medium 6.9
    CVE-2025-27533 Public exploit

    Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

    Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of …

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • High 8.5
    CVE-2024-32114 Public exploit

    Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

    In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can …

    Apache Software Foundation Apache ActiveMQ org.apache.activemq:apache-activemq Maven
  • High 8.8
    CVE-2022-41678 Public exploit EPSS 86%

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • Critical 10.0
    CVE-2023-46604 Exploited · Ransomware Public exploit EPSS 100%

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Legacy OpenWire Module activemq Debian Ubuntu Maven
    KEV Nov 2, 2023