CVE-2026-45505

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197. Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-45505 on 2026-07-27. Shown when MITRE's text differs from the cvelistV5 mirror.

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.  Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2026-06-01 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/apache-activemq-cve-2026-45505/

Linked Threat

CVE-2026-45505 — CVE-2026-45505

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-01 09:16:19 UTC

NVD last modified

2026-07-21 19:10:00 UTC

NVD CVSS v3.1

8.8 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

2.8 / 10

Impact subscore

5.9 / 10

EPSS score

0.0060 (probability of exploitation in next 30 days)

EPSS percentile

45.12% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-20, CWE-94 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-33576

Assigner

apache

Published

Jun 1, 2026, 7:22:32 AM

Updated

Jun 2, 2026, 3:55:45 AM

EUVD base score (CVSS 3.1)

8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.6000

Vendors

Apache Software Foundation

Products

Apache ActiveMQ (0 <5.19.7)

Apache ActiveMQ Broker (6.0.0 <6.2.6)

Apache ActiveMQ (6.0.0 <6.2.6)

Apache ActiveMQ All (0 <5.19.7)

Apache ActiveMQ All (6.0.0 <6.2.6)

Apache ActiveMQ Broker (0 <5.19.7)

Aliases

GHSA-v853-w46p-fv2h

ENISA description: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.  Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (9)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-45505 tenable:nvd.nist.gov
• https://www.first.org/epss/ tenable:www.first.org
• https://attackerkb.com/topics/CVE-2026-45505 rapid7:attackerkb.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33576 rapid7:euvd.enisa.europa.eu
• http://cwe.mitre.org/data/definitions/20.html rapid7:cwe.mitre.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-34197 rapid7:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45505 rapid7:www.cve.org
• https://lists.apache.org/thread/7n97nddyw96w6ykldjv1h40jx86xdo0w rapid7:lists.apache.org
• http://cwe.mitre.org/data/definitions/94.html rapid7:cwe.mitre.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Rapid7 — Solution
  rapid7

  apache-activemq-upgrade-latest

  2026-06-04 08:53 UTC
• Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0 ...
  web:cybersecuritynews.com

  No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.

  2026-06-19 02:32 UTC
• CVE-2026-45585: Windows Zero-Day Bypasses BitLocker
  web:dailysecurityreview.com

  Microsoft disclosed CVE - 2026 -45585, a Windows zero-day that allows attackers with physical access to bypass BitLocker encryption without the decryption key.

  2026-06-19 02:32 UTC
• Updated Mitigation Script for CVE-2026-45585 (BitLocker)
  web:its.wsu.edu

  Microsoft has updated the mitigation guidance for CVE - 2026 -45585, a vulnerability involving Windows BitLocker security feature bypass. The update replaces the previously documented manual mitigation steps with a deployment script that reduces exposure while a future security update is in development. The vulnerability impacts a limited set of platforms: Windows 11 versions 26H1, 25H2, and 24H2 ...

  2026-06-19 02:32 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Security Update Guide - Microsoft Security Response Center

  2026-06-19 02:32 UTC
• Nvd - Cve-2026-45500
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-06-19 02:32 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:32 UTC
• CVE-2026-45500 Exchange Spoofing: June 2026 Patch Guidance for Admins
  web:windowsforum.com

  Microsoft disclosed CVE - 2026 -45500, a Microsoft Exchange Server spoofing vulnerability, as part of the June 9, 2026 Exchange security updates for Exchange Server Subscription Edition and Exchange Server 2019 CU15, placing it among a cluster of Exchange flaws patched in the same release. The...

  2026-06-19 02:32 UTC
• Microsoft shares mitigation for YellowKey Windows zero-day
  web:www.bleepingcomputer.com

  Microsoft has shared mitigations for YellowKey, a recently disclosed Windows BitLocker zero-day vulnerability that grants access to protected drives.

  2026-06-19 02:32 UTC
• Microsoft is working on a patch for 'YellowKey ... - Computerworld
  web:www.computerworld.com

  Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...

  2026-06-19 02:32 UTC
• How To Mitigate The Microsoft Windows BitLocker YellowKey USB 0-Day
  web:www.forbes.com

  Following the release of a BitLocker zero-day security bypass by a disgruntled hacker, Microsoft has now offered mitigation advice until a patch is available.

  2026-06-19 02:32 UTC

Only Available for Registered Users. Sign in to view.