CVE-2026-52760: Apache ActiveMQ stored XSS in Web Console browse page

CVE-2026-52760 · Severity: medium · CVSS 6.1 · Published 2026-06-30

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A security vulnerability in its management web console allows an attacker to inject malicious scripts into the dashboard. If an administrator views the message queue, these scripts could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: Apache ActiveMQ, org.apache.activemq:activemq-web-console (Maven), org.apache.activemq:apache-activemq (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-52760 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52760 being exploited in the wild.
How severe is CVE-2026-52760?
Medium severity, with a CVSS score of 6.1, published 30 June 2026.
Which products and versions are affected?
Apache ActiveMQ before 5.19.8, 6.0.0 before 6.2.7; Apache ActiveMQ Web Console before 5.19.8, 6.0.0 before 6.2.7; org.apache.activemq:activemq-web-console (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8; org.apache.activemq:apache-activemq (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8.
Is there a fix for CVE-2026-52760?
Yes. org.apache.activemq:activemq-web-console (Maven): upgrade to 5.19.8 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52760 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-52760?
Check whether you run Apache ActiveMQ, Apache ActiveMQ Web Console, org.apache.activemq:activemq-web-console (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:activemq-web-console (Maven): upgrade to 5.19.8 or later
    # set org.apache.activemq:activemq-web-console to 5.19.8 in your pom.xml or build.gradle
  • org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.8 or later
    # set org.apache.activemq:apache-activemq to 5.19.8 in your pom.xml or build.gradle

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the Apache ActiveMQ Web Console. The 'browse' page fails to properly sanitize the JMS message ID before rendering it in the browser. An authenticated producer can craft a malicious message containing HTML or JavaScript within the message ID field. When an administrator views the queue via the Web Console, the payload executes in the context of their session. This can lead to session hijacking or unauthorized administrative actions. The issue is resolved in versions 5.19.8 and 6.2.7.

Affected products

  • Apache ActiveMQ before 5.19.8, 6.0.0 before 6.2.7
  • Apache ActiveMQ Web Console before 5.19.8, 6.0.0 before 6.2.7

Identifiers

  • CVE-2026-52760
  • BIT-ACTIVEMQ-2026-52760
  • GHSA-j548-68g5-9j7x

Timeline

  • 2026-06-30: disclosed
  • 2026-06-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.