CVE-2026-41044 - Vulnerability Analysis

Overview

Apache ActiveMQ < 5.19.6 and 6.0.0 < 6.2.5 contains a remote code execution caused by improper input validation allowing authenticated attackers to inject malicious broker names via the admin web console, letting attackers execute arbitrary code on the broker JVM, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can execute arbitrary code on the broker JVM, potentially leading to full system compromise.

Mitigation

Upgrade to version 6.2.5 or 5.19.6 or later.

References

• https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt
• http://www.openwall.com/lists/oss-security/2026/04/23/6

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner