Patchfirst
Patchfirst
ChainApache ActiveMQ BrokerMaven:org.apache.activemq:activemq-broker

Apache ActiveMQ Broker: fix bypasses (2026)

5 CVEs over 3 generations, 7 Apr 2026 to 1 Jun 2026. 1 is in .

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2026-341977 Apr 2026KEV First in the chain
  2. CVE-2026-4046624 Apr 2026 bypassed the fix for CVE-2026-34197
  3. CVE-2026-4104424 Apr 2026 next fix after CVE-2026-34197
  4. CVE-2026-425881 Jun 2026 next fix after CVE-2026-40466
  5. CVE-2026-455051 Jun 2026 bypassed the fix for CVE-2026-34197next fix after CVE-2026-40466
Apr 2026MayJun CVE-2026-34197 → CVE-2026-40466: bypassed the fix (high confidence)CVE-2026-34197 → CVE-2026-45505: bypassed the fix (high confidence)CVE-2026-34197 → CVE-2026-41044: Next fix in the same package (medium confidence)CVE-2026-40466 → CVE-2026-42588: Next fix in the same package (medium confidence)CVE-2026-40466 → CVE-2026-45505: Next fix in the same package (medium confidence) CVE-2026-34197 7 Apr 2026 CVE-2026-40466 24 Apr 2026 CVE-2026-41044 24 Apr 2026 CVE-2026-42588 1 Jun 2026 CVE-2026-45505 1 Jun 2026 Apr 2026MayJun CVE-2026-34197 → CVE-2026-40466: bypassed the fix (high confidence)CVE-2026-34197 → CVE-2026-45505: bypassed the fix (high confidence)CVE-2026-34197 → CVE-2026-41044: Next fix in the same package (medium confidence)CVE-2026-40466 → CVE-2026-42588: Next fix in the same package (medium confidence)CVE-2026-40466 → CVE-2026-45505: Next fix in the same package (medium confidence) CVE-2026-34197 7 Apr 2026 CVE-2026-40466 24 Apr 2026 CVE-2026-41044 24 Apr 2026 CVE-2026-42588 1 Jun 2026 CVE-2026-45505 1 Jun 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2026-34197KEV 7 Apr 2026 Apache ActiveMQ Improper Input Validation Vulnerability · fixed in 6.2.3 First in chain 74.1
CVE-2026-40466 24 Apr 2026 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery… · fixed in 6.2.5 CVE-2026-34197 · bypassed the fix · High 71.8
CVE-2026-41044 24 Apr 2026 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView… · fixed in 6.2.5 CVE-2026-34197 · Next fix in the same package · Medium 18.6
CVE-2026-42588 1 Jun 2026 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector · fixed in 6.2.6 CVE-2026-40466 · Next fix in the same package · Medium 21.6
CVE-2026-45505 1 Jun 2026 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass · fixed in 6.2.6 CVE-2026-34197 · bypassed the fix · High 15.9
↑ ↓ chooseEnter openEsc close