CVE-2026-40466: Apache ActiveMQ code injection via HTTP Discovery transport bypass

CVE-2026-40466 · Severity: high · CVSS 8.8 · Published 2026-04-24

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A security vulnerability allows an authenticated user to bypass previous security fixes and execute unauthorized commands on the server. This could lead to a complete takeover of the message broker, potentially resulting in data theft, service disruption, or further attacks on the internal network.

Technologies: Apache ActiveMQ, Apache Activemq Broker, org.apache.activemq:activemq-all (Maven), org.apache.activemq:activemq-broker (Maven), org.apache.activemq:apache-activemq (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-40466 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40466 being exploited in the wild.
How severe is CVE-2026-40466?
High severity, with a CVSS score of 8.8, published 24 April 2026.
Which products and versions are affected?
Apache ActiveMQ < 5.19.6, 6.0.0 to < 6.2.5; Apache Activemq Broker < 5.19.6, 6.0.0 to < 6.2.5; org.apache.activemq:activemq-all (Maven) ECOSYSTEM:introduced=0,fixed=5.19.6; org.apache.activemq:activemq-broker (Maven) ECOSYSTEM:introduced=0,fixed=5.19.6; and 1 more.
Is there a fix for CVE-2026-40466?
Yes. org.apache.activemq:activemq-all (Maven): upgrade to 5.19.6 or later; org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.6 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40466 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40466?
Check whether you run Apache ActiveMQ, Apache Activemq Broker, org.apache.activemq:activemq-all (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:activemq-all (Maven): upgrade to 5.19.6 or later
    # set org.apache.activemq:activemq-all to 5.19.6 in your pom.xml or build.gradle
  • org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.6 or later
    # set org.apache.activemq:activemq-broker to 5.19.6 in your pom.xml or build.gradle
  • org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.6 or later
    # set org.apache.activemq:apache-activemq to 5.19.6 in your pom.xml or build.gradle

Technical details

This vulnerability is a bypass of the fix for CVE-2026-34197. It occurs when an authenticated attacker adds a network connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through the Jolokia JMX-HTTP bridge. If the activemq-http module is on the classpath, a malicious HTTP endpoint can return a VM transport URI. This URI uses the 'brokerConfig' parameter to force the ResourceXmlApplicationContext to load a remote Spring XML application context. Because Spring instantiates singleton beans before the BrokerService validates the configuration, an attacker can achieve arbitrary code execution on the broker's JVM using bean factory methods like Runtime.exec(). The issue is resolved in versions 5.19.6 and 6.2.5.

Affected products

  • Apache ActiveMQ Broker < 5.19.6, 6.0.0 to < 6.2.5
  • Apache ActiveMQ All < 5.19.6, 6.0.0 to < 6.2.5
  • Apache ActiveMQ < 5.19.6, 6.0.0 to < 6.2.5

Identifiers

  • CVE-2026-40466
  • GHSA-w3w2-mpp5-92gm

Timeline

  • 2026-04-24: disclosed
  • 2026-04-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.