CVE-2026-42588

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-42588 on 2026-07-27. Shown when MITRE's text differs from the cvelistV5 mirror.

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2026-06-01 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/apache-activemq-cve-2026-42588/

Linked Threat

CVE-2026-42588 — CVE-2026-42588

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-01 09:16:19 UTC

NVD last modified

2026-07-22 07:10:00 UTC

NVD CVSS v3.1

8.1 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability subscore

2.8 / 10

Impact subscore

5.2 / 10

EPSS score

0.0057 (probability of exploitation in next 30 days)

EPSS percentile

43.61% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-20, CWE-94 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-33577

Assigner

apache

Published

Jun 1, 2026, 7:23:17 AM

Updated

Jun 2, 2026, 3:55:44 AM

EUVD base score (CVSS 3.1)

8.1 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EUVD-reported EPSS

0.5700

Vendors

Apache Software Foundation

Products

Apache ActiveMQ (6.0.0 <6.2.6)

Apache ActiveMQ All (0 <5.19.7)

Apache ActiveMQ Broker (6.0.0 <6.2.6)

Apache ActiveMQ Broker (0 <5.19.7)

Apache ActiveMQ (0 <5.19.7)

Apache ActiveMQ All (6.0.0 <6.2.6)

Aliases

GHSA-hg6c-8mvr-jqc9

ENISA description: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (9)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-42588 tenable:nvd.nist.gov
• https://www.first.org/epss/ tenable:www.first.org
• http://www.openwall.com/lists/oss-security/2026/05/31/18 tenable:www.openwall.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33577 rapid7:euvd.enisa.europa.eu
• http://cwe.mitre.org/data/definitions/20.html rapid7:cwe.mitre.org
• https://www.cve.org/CVERecord?id=CVE-2026-42588 rapid7:www.cve.org
• https://lists.apache.org/thread/ns0zktfo16s9ql2mmtqtlb6p6xcs45xm rapid7:lists.apache.org
• http://cwe.mitre.org/data/definitions/94.html rapid7:cwe.mitre.org
• https://attackerkb.com/topics/CVE-2026-42588 rapid7:attackerkb.com

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Rapid7 — Solution
  rapid7

  apache-activemq-upgrade-latest

  2026-06-04 08:53 UTC
• Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review
  web:blog.qualys.com

  May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

  2026-06-19 02:32 UTC
• CVE-2026-42588 | High Severity | Armis
  web:cve.armis.com

  CVE-2026-42588 (High, CVSS 8.1). Published 2026 . An authenticated attacker with any valid web console credentials can achieve remote code execution on an Apach…

  2026-06-19 02:32 UTC
• Nvd - Cve-2026-42588
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-06-19 02:32 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:32 UTC
• March 13, 2026—Hotpatch KB5084597 (OS Builds 26200.7982 and 26100.7982 ...
  web:support.microsoft.com

  The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change. [Networking] Fixed: This update addresses a security issue in the Windows Routing and Remote Access Service (RRAS) management tool. If you connect to a malicious remote server, an attacker could disrupt the tool or run code on your device. For more ...

  2026-06-19 02:32 UTC
• CVE-2026-42588 Observation Footprint | Bitsight
  web:www.bitsight.com

  Find CVE-2026-42588 country and industry Internet observation data, via Bitsight's Groma Internet scanner.

  2026-06-19 02:32 UTC
• Microsoft is working on a patch for 'YellowKey ... - Computerworld
  web:www.computerworld.com

  Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...

  2026-06-19 02:32 UTC
• May 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.

  2026-06-19 02:32 UTC
• Patch Tuesday - June 2026 - Rapid7
  web:www.rapid7.com

  Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday, including an HTTP/2 denial of service vulnerability and an elevation of privilege vulnerability in PowerToys.

  2026-06-19 02:32 UTC
• Patch Tuesday June 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-06-19 02:32 UTC

Only Available for Registered Users. Sign in to view.