Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. (CVE-2026-74761)
Affects activemqSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 5.19.11-1.oe2403sp1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.apache.activemq/activemq-brokerpkg:maven/org.apache.activemq/activemq-brokerOther threats | Affected
| Fixed in– |
Mavenorg.apache.activemq/activemq-allpkg:maven/org.apache.activemq/activemq-allOther threats | Affected
| Fixed in– |
Mavenorg.apache.activemq/activemqpkg:maven/org.apache.activemq/activemqOther threats | Affected
| Fixed in– |
openEuler:24.03-LTS-SP1activemqpkg:rpm/openEuler/activemq&distro=openEuler-24.03-LTS-SP1Other threats | Affected
| Fixed in
|
Ubuntu:Pro:16.04:LTSactivemqpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/xenialOther threats | Affected
| Fixed in– |
Ubuntu:Pro:18.04:LTSactivemqpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/bionicOther threats | Affected
| Fixed in– |
Ubuntu:Pro:20.04:LTSactivemqpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/focalOther threats | Affected
| Fixed in– |
Ubuntu:Pro:22.04:LTSactivemqpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/jammyOther threats | Affected
| Fixed in– |
Ubuntu:24.04:LTSactivemqpkg:deb/ubuntu/activemq?arch=source&distro=nobleOther threats | Affected
| Fixed in– |
Ubuntu:26.10activemqpkg:deb/ubuntu/activemq?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu:26.04:LTSactivemqpkg:deb/ubuntu/activemq?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
In the meantime, restrict access to authenticated clients and review subscription management policies to mitigate potential abuse.
Description
Apache ActiveMQ has an input validation vulnerability in the TopicRegion component that allows an authenticated client to spoof clientId when removing durable topic subscriptions. This flaw enables the removal of other users' durable topic subscriptions. The vulnerability affects multiple versions of ActiveMQ and is rated with medium severity.
Impact
An attacker with authentication can remove durable topic subscriptions belonging to other users by spoofing clientId values. This compromises the integrity of subscription management but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Summary
CVE-2026-74761 describes an input validation vulnerability in Apache ActiveMQ's TopicRegion component. An authenticated client can exploit this flaw to spoof the clientId during the removal of durable topic subscriptions, allowing unauthorized removal of other users' durable topic subscriptions. This vulnerability affects various versions of Apache ActiveMQ, including versions prior to 5.19.11, versions from 6.0.0 up to but not including 6.3.2, and several specific package versions. The CVSS v3.1 base score is 7.5, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-74761 (opens in a new tab)
- lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz (opens in a new tab)
- openwall.com/lists/oss-security/2026/09/08/12 (opens in a new tab)
- openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4049 (opens in a new tab)
- ubuntu.com/security/CVE-2026-74761 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-74761 (opens in a new tab)