CVE-2026-49157

Description

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-49157 on 2026-06-30. Shown when MITRE's text differs from the cvelistV5 mirror.

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2026-06-01 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/apache-activemq-cve-2026-49157/

Linked Threat

CVE-2026-49157 — CVE-2026-49157

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-01 09:16:20 UTC

NVD last modified

2026-06-17 10:55:33 UTC

NVD CVSS v3.1

8.8 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

2.8 / 10

Impact subscore

5.9 / 10

EPSS score

0.0042 (probability of exploitation in next 30 days)

EPSS percentile

33.95% vs all CVEs — higher = more likely to be exploited, as of 2026-06-30

NVD-assigned CWE(s): CWE-276 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-33574

Assigner

apache

Published

Jun 1, 2026, 7:20:10 AM

Updated

Jun 1, 2026, 2:42:33 PM

EUVD base score (CVSS 3.1)

8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.4200

Vendors

Apache Software Foundation

Products

Apache ActiveMQ (6.0.0 <6.2.6)

Apache ActiveMQ (0 <5.19.7)

Aliases

GHSA-99qx-5qqr-4j95

ENISA description: Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (8)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-49157 tenable:nvd.nist.gov
• http://www.openwall.com/lists/oss-security/2026/05/31/21 tenable:www.openwall.com
• https://www.first.org/epss/ tenable:www.first.org
• http://cwe.mitre.org/data/definitions/276.html rapid7:cwe.mitre.org
• https://www.cve.org/CVERecord?id=CVE-2026-49157 rapid7:www.cve.org
• https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8 rapid7:lists.apache.org
• https://attackerkb.com/topics/CVE-2026-49157 rapid7:attackerkb.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33574 rapid7:euvd.enisa.europa.eu

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Rapid7 — Solution
  rapid7

  apache-activemq-upgrade-latest

  2026-06-04 08:53 UTC
• Security Advisories - ActiveMQ Classic
  web:activemq.apache.org

  CVE - 2026 -40046 - Missing fix for CVE -2025-66168: MQTT control packet remaining length field is not properly validated CVE - 2026 -39304 - Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM

  2026-06-19 02:32 UTC
• CVE-2026-49157 - Vulnerability Details - OpenCVE
  web:app.opencve.io

  No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade ActiveMQ to version 5.19.7 or 6.2.6, which removes the default unrestricted Jolokia permissions for low‑privilege web users If an upgrade is not feasible, modify the Jolokia authorization configuration to explicitly deny non‑admin users from broker‑management operations such as addQueue and removeQueue ...

  2026-06-19 02:32 UTC
• Ubiquiti rushes out emergency fix for critical bug in UniFi Network ...
  web:cybernews.com

  Ubiquiti has released emergency updates for its UniFi Network Application - a critical vulnerability allows hackers to compromise systems without credentials.

  2026-06-19 02:32 UTC
• Microsoft June 2026 Patch Tuesday fixes 206 flaws, including CVE-2026 ...
  web:cybersixt.com

  Microsoft released its June 2026 Patch Tuesday updates, addressing 206 security vulnerabilities across Windows and related software, of which three were publicly disclosed zero‑day flaws, including an HTTP/2 bomb vulnerability ( CVE - 2026 -49160). The patches are now available for installation; administrators are advised to apply them promptly to mitigate potential exploitation.

  2026-06-19 02:32 UTC
• NVD - Home
  web:nvd.nist.gov

  The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

  2026-06-19 02:32 UTC
• CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
  web:security.paloaltonetworks.com

  Palo Alto Networks Security Advisory: CVE - 2026 -0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

  2026-06-19 02:32 UTC
• Description of the security update for Microsoft Exchange Server ...
  web:support.microsoft.com

  Note: The fix for CVE - 2026 -45583 is not included in the Security Update, please follow the instructions mentioned in the CVE documentation to address this vulnerability.

  2026-06-19 02:32 UTC
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
  web:techcommunity.microsoft.com

  UPDATE June 9, 2026 : Please see our release blog post for June 2026 Security Update for more information on this CVE : Released: June 2026 Exchange Server Security Updates | Microsoft Community Hub. On May 14, 2026 , Microsoft disclosed CVE - 2026 -42897, a reported vulnerability affecting Exchange Outlook Web Access (OWA). An attacker could exploit this issue by sending a specially crafted email ...

  2026-06-19 02:32 UTC
• CVE-2026-45657: Critical Windows Kernel RCE Patch Guide (June 2026)
  web:windowsforum.com

  Microsoft disclosed CVE - 2026 -45657 on June 9, 2026 , as a critical Windows Kernel remote code execution vulnerability affecting supported Windows 11 and Windows Server releases, with patches available through the June security updates and a CVSS base score of 9.8. The advisory is short, but the...

  2026-06-19 02:32 UTC
• Oracle Critical Patch Update Advisory - January 2026
  web:www.oracle.com

  Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

  2026-06-19 02:32 UTC

Only Available for Registered Users. Sign in to view.