CVE-2026-52760 is a CWE-79 cross-site scripting vulnerability in Apache ActiveMQ's Web Console. The browse page directly renders JMS message IDs without sanitization, enabling an authenticated producer to inject HTML/JavaScript payloads. When an administrator browses the queue, the malicious script executes in their browser context. This affects Apache ActiveMQ versions prior to 5.19.8 and from 6.0.0 up to but not including 6.2.7. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. The issue is fixed in Apache ActiveMQ versions 5.19.8 and 6.2.7.

An authenticated producer can inject malicious scripts into JMS message IDs, which execute in the browser of an administrator viewing the queue in the Web Console. This can lead to limited confidentiality and integrity impact within the context of the administrator's browser session. There is no indication of availability impact. The vulnerability requires authentication and user interaction (administrator browsing the queue).

Users should upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated in the vendor advisory, but the description clearly recommends upgrading to these fixed versions.