Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Priority MEDIUM 40CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00623 50th percentileScored 2026-11-07
Fix Fixed Apache ActiveMQ Broker (Apache Software Foundation): 6.3.2, 5.19.11Apache ActiveMQ All (Apache Software Foundation): 6.3.2, 5.19.11+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ Broker | 6.0.0 to before 6.3.2; before 5.19.11 | 6.3.2, 5.19.11 | Patch available | CNA |
| Apache | Apache ActiveMQ All | 6.0.0 to before 6.3.2; before 5.19.11 | 6.3.2, 5.19.11 | Patch available | CNA |
| Apache | Apache ActiveMQ | 6.0.0 to before 6.3.2; before 5.19.11 | 6.3.2, 5.19.11 | Patch available | CNA |
- Apache ActiveMQ Broker VendorApache Affected 6.0.0 to before 6.3.2; before 5.19.11 Fixed in 6.3.2, 5.19.11 Patch available CNA
- Apache ActiveMQ All VendorApache Affected 6.0.0 to before 6.3.2; before 5.19.11 Fixed in 6.3.2, 5.19.11 Patch available CNA
- Apache ActiveMQ VendorApache Affected 6.0.0 to before 6.3.2; before 5.19.11 Fixed in 6.3.2, 5.19.11 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | before 5.19.11; 6.0.0 to before 6.3.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:* | before 5.19.11; 6.0.0 to before 6.3.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:* | before 5.19.11; 6.2.0 to before 6.3.2 | Vulnerable | Apache |
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.19.11; 6.0.0 to before 6.3.2 Vulnerable ·Apache
- cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:* Versions before 5.19.11; 6.0.0 to before 6.3.2 Vulnerable ·Apache
- cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:* Versions before 5.19.11; 6.2.0 to before 6.3.2 Vulnerable ·Apache
Remediation
- Fix · CNA Apache ActiveMQ Broker (Apache Software Foundation) Fixed in 6.3.2, 5.19.11
- Fix · CNA Apache ActiveMQ All (Apache Software Foundation) Fixed in 6.3.2, 5.19.11
- Fix · CNA Apache ActiveMQ (Apache Software Foundation) Fixed in 6.3.2, 5.19.11
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-74761
- 2026-10-03 Alias added: GHSA-hx9m-72qj-2q46
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
- 2026-11-04 EPSS moved to the 50th–90th percentile
References
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-74761 · CVE Program
- CVE-2026-74761 · NVD
- FIRST EPSS
- GHSA-hx9m-72qj-2q46 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-74761 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences