Is CVE-2026-108946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108946 being exploited in the wild.

How severe is CVE-2026-108946?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Apache ActiveMQ 6.0.0 before 6.3.3, 5.x before 5.19.12; Apache ActiveMQ KahaDB 6.0.0 before 6.3.3, 5.x before 5.19.12.

Is there a fix for CVE-2026-108946?

Yes: fixed in ActiveMQ 6.4.0, 6.3.3, or 5.19.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108946 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-108946?

Check whether you run Apache ActiveMQ or Apache ActiveMQ KahaDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108946: Apache ActiveMQ improper input validation in connection state handling

CVE-2026-108946 · Severity: info · Published 2026-11-04

Apache ActiveMQ is a message broker that handles communications between applications. An authenticated attacker can forge connection and consumer identifiers to impersonate other users, potentially consuming messages intended for others, disrupting subscriptions, or permanently deleting in-flight messages. This could lead to data loss, message interception, and denial of service for legitimate users.

Technologies: Apache ActiveMQ. Vendors: Apache.

Quick answers

Is CVE-2026-108946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108946 being exploited in the wild.
How severe is CVE-2026-108946?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Apache ActiveMQ 6.0.0 before 6.3.3, 5.x before 5.19.12; Apache ActiveMQ KahaDB 6.0.0 before 6.3.3, 5.x before 5.19.12.
Is there a fix for CVE-2026-108946?: Yes: fixed in ActiveMQ 6.4.0, 6.3.3, or 5.19.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108946 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-108946?: Check whether you run Apache ActiveMQ or Apache ActiveMQ KahaDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ActiveMQ 6.4.0, 6.3.3, or 5.19.12

Technical details

The vulnerability is an improper input validation issue in ActiveMQ's connection, session, and consumer state resolution logic. Authenticated clients can forge peer identifiers (connection IDs, consumer IDs) because the broker does not validate that these IDs belong to the requesting user, allowing spoofing of other users' state. An attacker can consume from temporary queues, tear down victim subscriptions, or forge message acknowledgments to delete unacknowledged messages.

Affected products

Apache ActiveMQ 6.0.0 before 6.3.3, 5.x before 5.19.12
Apache ActiveMQ KahaDB 6.0.0 before 6.3.3, 5.x before 5.19.12

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.