CVE-2026-41044: CWE-20 Improper Input Validation in Apache Software Foundation Apache ActiveMQ
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
AI Analysis
Technical Summary
This vulnerability arises from improper input validation in Apache ActiveMQ's admin web console, allowing an authenticated attacker to craft a malicious broker name containing an xbean binding. This malicious broker name can be used by a VM transport to load a remote Spring XML application. Because Spring's ResourceXmlApplicationContext instantiates singleton beans before BrokerService validates configuration, arbitrary code execution can occur through bean factory methods such as Runtime.exec(). The vulnerability affects Apache ActiveMQ versions before 5.19.6 and from 6.0.0 before 6.2.5. The recommended fix is upgrading to 5.19.6 or 6.2.5.
Potential Impact
An authenticated attacker can achieve arbitrary code execution on the Apache ActiveMQ broker's JVM by exploiting improper input validation that leads to loading a malicious Spring XML context. This results in full confidentiality, integrity, and availability compromise of the affected broker service.
Mitigation Recommendations
A fix is available. Users are strongly advised to upgrade Apache ActiveMQ to version 5.19.6 or 6.2.5, which address this vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated in the advisory.
CVE-2026-41044: CWE-20 Improper Input Validation in Apache Software Foundation Apache ActiveMQ
Description
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
CVSS v3.1
Score 8.8high
Affected software
pkg:maven/org.apache.activemq/activemq-brokerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper input validation in Apache ActiveMQ's admin web console, allowing an authenticated attacker to craft a malicious broker name containing an xbean binding. This malicious broker name can be used by a VM transport to load a remote Spring XML application. Because Spring's ResourceXmlApplicationContext instantiates singleton beans before BrokerService validates configuration, arbitrary code execution can occur through bean factory methods such as Runtime.exec(). The vulnerability affects Apache ActiveMQ versions before 5.19.6 and from 6.0.0 before 6.2.5. The recommended fix is upgrading to 5.19.6 or 6.2.5.
Potential Impact
An authenticated attacker can achieve arbitrary code execution on the Apache ActiveMQ broker's JVM by exploiting improper input validation that leads to loading a malicious Spring XML context. This results in full confidentiality, integrity, and availability compromise of the affected broker service.
Mitigation Recommendations
A fix is available. Users are strongly advised to upgrade Apache ActiveMQ to version 5.19.6 or 6.2.5, which address this vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-04-16T13:02:49.030Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-41044","vendor":"Red Hat"}]
Threat ID: 69eb479387115cfb681fd011
Added to database: 04/24/2026, 10:36:03 UTC
Last enriched: 07/15/2026, 08:12:45 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 116
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.