Missing authentication in Apache ActiveMQ
Priority LOW 18CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-306.
Summary
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
Why it matters now
EPSS 0.01966 80th percentileScored 2026-11-07
Fix Partial org.apache.activemq:activemq-client (Maven): 5.14.5Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | ActiveMQ | 5.15.5 | — | No fix listed | CNA |
| — | org.apache.activemq:activemq-client (Maven) | before 5.14.5 | 5.14.5 | Patch available | GHSA-jvpp-hxjj-5ccc |
- ActiveMQ VendorApache Affected 5.15.5 Fixed in — No fix listed CNA
- org.apache.activemq:activemq-client (Maven) Vendor— Affected before 5.14.5 Fixed in 5.14.5 Patch available GHSA-jvpp-hxjj-5ccc
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | before 5.14.5; 5.15.0 to before 5.15.5 | Vulnerable | Apache |
| cpe:2.3:a:redhat:jboss_a-mq:6.2.1:*:*:*:*:*:*:* | 6.2.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_a-mq:6.3:*:*:*:*:*:*:* | 6.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:6.3:*:*:*:*:*:*:* | 6.3 | Vulnerable | Red Hat |
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.14.5; 5.15.0 to before 5.15.5 Vulnerable ·Apache
- cpe:2.3:a:redhat:jboss_a-mq:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_a-mq:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-jvpp-hxjj-5ccc org.apache.activemq:activemq-client (Maven) Fixed in 5.14.5 Advisory →
Red Hat 1 advisory
- RHSA-2017:0868 Released 2017-04-03 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:0868 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:0868 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7559
- 2026-10-03 Alias added: GHSA-jvpp-hxjj-5ccc
References
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2015-7559 · CVE Program
- CVE-2015-7559 · NVD
- FIRST EPSS
- GHSA-jvpp-hxjj-5ccc · GitHub Advisory Database · CC BY 4.0
- CVE-2015-7559 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences