PatchSiren cyber security CVE debrief

CVE-2026-41044 Apache Software Foundation CVE debrief

CVE-2026-41044 is a critical vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All. The vulnerability is caused by improper input validation and code injection, allowing an authenticated attacker to construct a malicious broker name that bypasses name validation. This can lead to arbitrary code execution on the broker's JVM. The vulnerability affects Apache ActiveMQ versions before 5.19.6 and 6.0.0 to 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6 to fix the issue. The CVSS score for this vulnerability is 8.8, indicating a high severity. The vulnerability was published on April 24, 2026, and modified on June 30, 2026.

Vendor: Apache Software Foundation
Product: Apache ActiveMQ
CVSS: HIGH 8.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-24
Original CVE updated: 2026-07-15
Advisory published: 2026-04-24
Advisory updated: 2026-07-15

Who should care

Apache ActiveMQ users, administrators, and security teams should be aware of this vulnerability and take immediate action to upgrade to a fixed version. Additionally, security teams should monitor for potential exploitation attempts and review their inventory of affected systems. Red Hat users can also refer to the related bug report and security advisories for more information.

Technical summary

The vulnerability is caused by improper input validation and code injection in Apache ActiveMQ. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation, leading to arbitrary code execution on the broker's JVM. The attacker can use the DestinationView mbean to send a message to trigger a VM transport creation that references the malicious broker name, loading the malicious Spring XML context file. This allows for code execution through bean factory methods such as Runtime.exec().

Defensive priority

High priority should be given to upgrading Apache ActiveMQ to version 6.2.5 or 5.19.6. Additionally, security teams should monitor for potential exploitation attempts and review their inventory of affected systems.

Recommended defensive actions

Upgrade Apache ActiveMQ to version 6.2.5 or 5.19.6
Monitor for potential exploitation attempts
Review inventory of affected systems
Refer to related bug report and security advisories for more information
Implement additional security measures to prevent code injection attacks

Evidence notes

The vulnerability was published on April 24, 2026, and modified on June 30, 2026. The CVSS score for this vulnerability is 8.8, indicating a high severity. The vulnerability affects Apache ActiveMQ versions before 5.19.6 and 6.0.0 to 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6 to fix the issue.

Sources and references

Verified primary and authoritative sources

CVE-2026-41044 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-41044

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-41044 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41044

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt

[email protected] - Mailing List, Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-41044

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41044.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.