CVE-2026-40466 Public exploit High · 8.8 EPSS 4.8%

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery…

Apache Software Foundation · Apache ActiveMQ Broker

Official description · CVE.org

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.

Breakdown

71.8 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 13 days after disclosure.

Disclosed24 Apr 2026day 0
First seen exploitedVulnCheck KEV evidence7 May 2026+13 days

See the family tree

A fix was bypassed or incomplete 2 times over 8 weeks. The latest fix listed for activemq-broker is 6.2.6.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2026-34197ActiveMQ Improper Input Validation7 Apr 2026KEV
bypassed the fixHigh
Why these are linked:
- Stated in the CVE textAn authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the cla…
- Fixed one release later5.19.5 → 5.19.6 (org.apache.activemq:activemq-broker)
- Fixed one release later5.19.5 → 5.19.6 (org.apache.activemq:activemq-all)
- Similar weakness in the same product (machine-matched)same package + description similarity
This CVECVE-2026-40466ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible…24 Apr 2026
same family
CVE-2026-41044ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All…24 Apr 2026
same family
CVE-2026-42588ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote…1 Jun 2026
same family
CVE-2026-45505ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia…1 Jun 2026

Fixes in activemq-brokerMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

6.2.2CVE-2026-332277 Apr 2026
6.2.3CVE-2026-341977 Apr 2026KEV
6.2.4CVE-2026-3930410 Apr 2026
6.2.5CVE-2026-4046624 Apr 2026
6.2.5CVE-2026-4104324 Apr 2026
6.2.5CVE-2026-4104424 Apr 2026
6.2.6CVE-2026-425881 Jun 2026
6.2.6CVE-2026-455051 Jun 2026
6.2.6CVE-2026-492701 Jun 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. No single main package: each of these ships the affected code.

Mavenorg.apache.activemq:apache-activemq
Affected: 6.0.0 up to 6.2.5; All versions before 5.19.6Upgrade to 6.2.5 or later (older lines: 5.19.6)
GHSA-w3w2-mpp5-92gm
Mavenorg.apache.activemq:activemq-all
Affected: 6.0.0 up to 6.2.5; All versions before 5.19.6Upgrade to 6.2.5 or later (older lines: 5.19.6)
GHSA-w3w2-mpp5-92gm
Mavenorg.apache.activemq:activemq-broker
Affected: 6.0.0 up to 6.2.5; All versions before 5.19.6Upgrade to 6.2.5 or later (older lines: 5.19.6)
GHSA-w3w2-mpp5-92gm

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 9 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2026-25410

Public exploitAdvisories link exploit code.

, 30 Oct 2026

4.8%Top 8.1%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 91.9%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 177 days ago 5.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9192 18.4/20

Threat reports0 reports 0.0/10

Public exploit code1 nuclei template 5.0/5

Mentioned in OTX pulses9 pulses 2.3/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productsupported or unknown 0.0

Total71.8

Record

Published: 24 Apr 2026
Modified: 15 Jul 2026
: CWE-20 Improper Input ValidationCWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in activemq-brokerMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

What security researchers reported

Also mentioned in 9 community threat pulses (AlienVault OTX)

References

vendor-advisory 1

vdb-entry 1

issue-tracking 1

x_sadp-csaf-vex 1

techniques