CVE-2026-41044

Full vulnerability record from the local CVENow database.
Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
Severity
HIGH
CVSS score
8.8 (v3.1)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2026-04-24 11:16:22.790000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
  "id": "CVE-2026-41044",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-24T11:16:22.790",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.\n\nAn authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application.\nThe attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file.\n\n\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de validación de entrada incorrecta, control incorrecto de la generación de código (’Inyección de código’) en Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.\n\nUn atacante autenticado puede usar la página de la consola web de administración para construir un nombre de broker malicioso que omite la validación de nombre para incluir un enlace xbean que puede ser usado posteriormente por un transporte VM para cargar una aplicación Spring XML remota.\nEl atacante puede entonces usar el mbean DestinationView para enviar un mensaje que active la creación de un transporte VM que hará referencia a este nombre de broker malicioso, lo que puede llevar a la carga del archivo de contexto Spring XML malicioso.\n\nDebido a que ResourceXmlApplicationContext de Spring instancia todos los beans singleton antes de que BrokerService valide la configuración, ocurre ejecución de código arbitrario en la JVM del broker a través de métodos de fábrica de beans como Runtime.exec().\n\nEste problema afecta a Apache ActiveMQ: antes de 5.19.6, desde 6.0.0 antes de 6.2.5; Apache ActiveMQ Broker: antes de 5.19.6, desde 6.0.0 antes de 6.2.5; Apache ActiveMQ All: antes de 5.19.6, desde 6.0.0 antes de 6.2.5.\n\nSe recomienda a los usuarios actualizar a la versión 6.2.5 o 5.19.6, que corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:apache-activemq",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.19.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "lessThan": "6.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ Broker",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:activemq-broker",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.19.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "lessThan": "6.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ All",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:activemq-all",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.19.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "lessThan": "6.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat AMQ Broker 7",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-broker",
          "cpes": [
            "cpe:/a:redhat:amq_broker:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Data Grid 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-broker",
          "cpes": [
            "cpe:/a:redhat:jboss_data_grid:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "log4j:2/log4j",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "log4j",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-all",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-broker",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-broker",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-broker",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "activemq-broker",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-24T00:00:00+00:00",
          "id": "CVE-2026-41044",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.19.6",
              "matchCriteriaId": "550C287A-18F0-462A-BFC9-2AD8A64B951A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndExcluding": "6.2.5",
              "matchCriteriaId": "F7BDD719-DDF9-42A2-AD9D-05FB6D758EF1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.19.6",
              "matchCriteriaId": "8799E3CE-EA55-4470-9582-D1948706DEAF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndExcluding": "6.2.5",
              "matchCriteriaId": "429CAFE7-6C7F-4670-B62D-C0D4D97D440F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/23/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-41044",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461409",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41044.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}