activemq broker vulnerabilities and fixes

Recent CVEs affecting activemq broker, with upgrade or downgrade steps. 6 tracked.

Also searched as: activemqbroker.

activemq broker has 6 tracked vulnerabilities, 0 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 6. Most recent: 2026-09-09. Highest priority: CVE-2026-34197 (score 91/100).

• CVE-2026-34197 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Apache ActiveMQ Improper Input Validation Vulnerability
• CVE-2026-40466 HIGH 8.8 UPGRADE UPGRADE Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache A
• CVE-2026-33227 MEDIUM 4.3 UPGRADE UPGRADE Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apach
• CVE-2026-39304 HIGH 7.5 UPGRADE UPGRADE Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache Ac
• CVE-2026-41044 HIGH 8.8 UPGRADE UPGRADE Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache A
• CVE-2026-74761 HIGH 7.5 UPGRADE UPGRADE Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All o

FAQ

How do I fix activemq broker vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is activemq broker being exploited right now?

Yes: 1 activemq broker CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which activemq broker CVE should I patch first?

CVE-2026-34197 currently ranks highest (91/100): Apache ActiveMQ Improper Input Validation Vulnerability.

RSS feed for activemq broker · ← Back to latest CVEs