Code Injection Vulnerability in Apache ActiveMQ Broker by Apache

CVE-2026-42588

What is CVE-2026-42588?

Apache ActiveMQ Classic has a vulnerability due to improper input validation. The Jolokia JMX-HTTP bridge allows authenticated attackers to perform exec operations on ActiveMQ MBeans by using a crafted discovery URI. This manipulation could trigger arbitrary code execution on the broker's JVM by loading a Spring XML application context. The vulnerability impacts various versions of Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ products, urging users to upgrade to the fixed versions 5.19.7 or 6.2.6 to mitigate the risks.

References