{"cve":"CVE-2026-41044","nvd":{"published":"2026-04-24T11:16:22.790","modified":"2026-10-26T21:10:00.170","status":"Modified","description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.\n\nAn authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application.\nThe attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file.\n\n\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-20","CWE-94"],"references":["https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt","http://www.openwall.com/lists/oss-security/2026/04/23/6","https://access.redhat.com/security/cve/CVE-2026-41044","https://bugzilla.redhat.com/show_bug.cgi?id=2461409","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41044.json"],"products":["apache:activemq","apache:activemq_broker"],"source":"nvd","synced_at":"2026-10-26T21:38:48.864438205+00:00"},"epss":{"cve":"CVE-2026-41044","score":0.0098,"percentile":0.61978,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-mr6m-xj7v-3cv3","url":"https://osv.dev/vulnerability/GHSA-mr6m-xj7v-3cv3","summary":"Apache ActiveMQ Vulnerable to Code Injection","modified":"2026-09-10T03:50:44.922924020Z","packages":[{"ecosystem":"Maven","name":"org.apache.activemq:apache-activemq","purl":"pkg:maven/org.apache.activemq/apache-activemq","ranges":["<5.19.6"],"fixed":["5.19.6"]},{"ecosystem":"Maven","name":"org.apache.activemq:activemq-all","purl":"pkg:maven/org.apache.activemq/activemq-all","ranges":["<5.19.6"],"fixed":["5.19.6"]},{"ecosystem":"Maven","name":"org.apache.activemq:activemq-broker","purl":"pkg:maven/org.apache.activemq/activemq-broker","ranges":["<5.19.6"],"fixed":["5.19.6"]},{"ecosystem":"Maven","name":"org.apache.activemq:apache-activemq","purl":"pkg:maven/org.apache.activemq/apache-activemq","ranges":[">=6.0.0 <6.2.5"],"fixed":["6.2.5"]},{"ecosystem":"Maven","name":"org.apache.activemq:activemq-all","purl":"pkg:maven/org.apache.activemq/activemq-all","ranges":[">=6.0.0 <6.2.5"],"fixed":["6.2.5"]},{"ecosystem":"Maven","name":"org.apache.activemq:activemq-broker","purl":"pkg:maven/org.apache.activemq/activemq-broker","ranges":[">=6.0.0 <6.2.5"],"fixed":["6.2.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}