`CVE-2026-45505`

Affected software	2 products, listed below
Severity	8.8 High CVSS 3.1
Fixed in	`5.19.7`, `6.2.6`
Weakness	Code injection (CWE-94)
Published	1 Jun 2026
Updated	21 Jul 2026

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... incorrectly pass validation allowing bypass of fix in CVE-2026-34197. Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

CWE-20 · Improper input validation

Exploitation status

No public exploit

No exploit has been reported in the sources we check.

CISA KEV not listed
VulnCheck KEV not listed
CISA Vulnrichment exploitation: none
Indexed PoC none indexed
EPSS 0.60% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists.

Protection none
Action unverified
Review automated Upstream data
Record active

Decided by	Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all
Finding	This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.

Decided by

Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all

Finding

This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev

Package Introduced Fixed Last affected

org.apache.activemq:activemq-broker 0 5.19.7 unbounded

org.apache.activemq:activemq-broker 6.0.0 6.2.6 unbounded

org.apache.activemq:activemq-all 0 5.19.7 unbounded

org.apache.activemq:activemq-all 6.0.0 6.2.6 unbounded

org.apache.activemq:apache-activemq 0 5.19.7 unbounded

org.apache.activemq:apache-activemq 6.0.0 6.2.6 unbounded

Package	Introduced	Fixed	Last affected
`org.apache.activemq:activemq-broker`	0	`5.19.7`	unbounded
`org.apache.activemq:activemq-broker`	6.0.0	`6.2.6`	unbounded
`org.apache.activemq:activemq-all`	0	`5.19.7`	unbounded
`org.apache.activemq:activemq-all`	6.0.0	`6.2.6`	unbounded
`org.apache.activemq:apache-activemq`	0	`5.19.7`	unbounded
`org.apache.activemq:apache-activemq`	6.0.0	`6.2.6`	unbounded

Products and versions

5 products, 10 version entries

Source	Vendor	Product	Scheme	Affected versions
nvd	apache	activemq	generic	＜ 5.19.7 · ≥ 6.0.0 and ＜ 6.2.6
nvd	apache	activemq broker	generic	＜ 5.19.7 · ≥ 6.0.0 and ＜ 6.2.6
osv	org.apache.activemq	activemq-all	generic	＜ 5.19.7 · ≥ 6.0.0 and ＜ 6.2.6
osv	org.apache.activemq	activemq-broker	generic	＜ 5.19.7 · ≥ 6.0.0 and ＜ 6.2.6
osv	org.apache.activemq	apache-activemq	generic	＜ 5.19.7 · ≥ 6.0.0 and ＜ 6.2.6

Source

Vendor

Product

Scheme

Affected versions

nvd

apache

activemq

generic