PT-2026-88926

CVE-2026-74761

Published

2026-09-09

Updated

2026-09-25

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.11 Apache ActiveMQ versions 6.0.0 through 6.3.1 Apache ActiveMQ Broker versions prior to 5.19.11 Apache ActiveMQ Broker versions 6.0.0 through 6.3.1 Apache ActiveMQ All versions prior to 5.19.11 Apache ActiveMQ All versions 6.0.0 through 6.3.1

Description Improper input validation in TopicRegion allows an authenticated client to spoof the clientId when removing a durable topic subscription.

Recommendations Upgrade Apache ActiveMQ to version 5.19.11 or 6.3.2. Upgrade Apache ActiveMQ Broker to version 5.19.11 or 6.3.2. Upgrade Apache ActiveMQ All to version 5.19.11 or 6.3.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Wanxin Yin

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2026-74761