Remote Code Execution Vulnerability in Apache ActiveMQ

CVE-2026-111241

What is CVE-2026-111241?

A vulnerability in Apache ActiveMQ allows local attackers with write access to the system's temporary directory to exploit the passivation strategy of non-default stateful session beans. By manipulating predictably named files in this directory, they can read sensitive passivated session states or inject malicious data for the server to deserialize. This could lead to unauthorized access or potential remote code execution, compromising the server's integrity. It is advised that users upgrade to versions 10.3.0 or 11.0.0-M2 to mitigate this threat.

References