Code Injection Vulnerability in Apache ActiveMQ Products

CVE-2026-45505

What is CVE-2026-45505?

A code injection vulnerability exists in Apache ActiveMQ due to improper input validation within the JMX-HTTP bridge. Specifically, the validation failure can allow an authenticated attacker to execute arbitrary code on the broker's JVM. The vulnerability arises when crafted discovery URIs are processed, allowing access to operations that should be restricted. For exploitation, attackers may invoke operations such as adding connectors that can trigger the loading of remote Spring XML application contexts, inadvertently executing arbitrary code due to the premature instantiation of singleton beans. It is essential for users to upgrade to the recommended versions 5.19.7 or 6.2.6 to mitigate this risk.

References