Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. (CVE-2026-52760)
Description
CVE-2026-52760 is a cross-site scripting (XSS) vulnerability in Apache ActiveMQ and its Web Console. The vulnerability arises because the browse page in the web console renders JMS message IDs without proper sanitization. An authenticated producer can craft a message ID containing malicious HTML or JavaScript, which executes in the browser of an administrator viewing the queue. This affects Apache ActiveMQ versions before 5.19.8 and from 6.0.0 before 6.2.7. Upgrading to versions 5.19.8 or 6.2.7 or later mitigates the issue.
CVSS v3.1
Score 6.1medium
Affected software
pkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/activemq?arch=source&distro=noblepkg:deb/ubuntu/activemq?arch=source&distro=questingpkg:deb/ubuntu/activemq?arch=source&distro=stonkingpkg:deb/ubuntu/activemq?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper neutralization of input during web page generation in Apache ActiveMQ's Web Console. Specifically, the browse page renders JMS message IDs directly without sanitization, allowing an authenticated producer to inject HTML/JavaScript payloads into message IDs. When an administrator browses the queue, the malicious script executes in their browser context, leading to a cross-site scripting attack. The affected versions include Apache ActiveMQ before 5.19.8 and from 6.0.0 before 6.2.7. The issue is fixed in Apache ActiveMQ versions 5.19.8 and 6.2.7.
Potential Impact
An authenticated producer can exploit this vulnerability to execute arbitrary JavaScript in the browser of an administrator using the Web Console. This could lead to session hijacking, unauthorized actions in the admin interface, or other client-side impacts. The CVSS score is 6.1 (medium severity), reflecting the need for authentication but the potential for significant impact on confidentiality and integrity within the administrative context.
Mitigation Recommendations
A fix is available. Users should upgrade Apache ActiveMQ and the Web Console to version 5.19.8 or 6.2.7 or later to remediate this vulnerability. No additional vendor advisory states alternative mitigations or no-action requirements.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-52760
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f6072cdf04f656664032
Added to database: 10/17/2026, 22:26:15 UTC
Last enriched: 10/18/2026, 00:55:48 UTC
Last updated: 10/18/2026, 00:55:48 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.