PT-2026-45381

CVE-2026-49157

Published

2026-06-01

Updated

2026-06-24

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5

Description Incorrect default permissions in Jolokia authorization settings allow authenticated low-privilege web-login accounts to access operations intended for administrators. This enables non-admin users to execute broker management operations, such as addQueue() and removeQueue().

Recommendations Update versions prior to 5.19.7 to version 5.19.7. Update versions 6.0.0 through 6.2.5 to version 6.2.6.

Exploitability

Exploit

Fix

Impacts

Researchers

Leon Johnson

Vendors

Affected products

Weakness enumeration

CWE-276: Incorrect Default Permissions

Related identifiers