Is CVE-2026-74761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74761 being exploited in the wild.

How severe is CVE-2026-74761?

High severity, with a CVSS score of 7.5, published 9 September 2026.

Which products and versions are affected?

Apache ActiveMQ before 5.19.11, 6.0.0 through 6.3.1; Apache Activemq Broker before 5.19.11, 6.0.0 through 6.3.1.

Is there a fix for CVE-2026-74761?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-74761 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-74761?

Check whether you run Apache ActiveMQ or Apache Activemq Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74761: Apache ActiveMQ input validation bypass in TopicRegion

CVE-2026-74761 · Severity: high · CVSS 7.5 · Published 2026-09-09

Apache ActiveMQ is a widely-used open-source message broker that handles communication between enterprise applications. An authenticated attacker can spoof the client identity when removing durable topic subscriptions, potentially allowing them to interfere with other users' subscriptions or subscriptions belonging to other applications sharing the same broker.

Technologies: Apache ActiveMQ, Apache Activemq Broker. Vendors: Apache.

Quick answers

Is CVE-2026-74761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74761 being exploited in the wild.
How severe is CVE-2026-74761?: High severity, with a CVSS score of 7.5, published 9 September 2026.
Which products and versions are affected?: Apache ActiveMQ before 5.19.11, 6.0.0 through 6.3.1; Apache Activemq Broker before 5.19.11, 6.0.0 through 6.3.1.
Is there a fix for CVE-2026-74761?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-74761 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-74761?: Check whether you run Apache ActiveMQ or Apache Activemq Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation flaw in the TopicRegion component of Apache ActiveMQ. An authenticated client can forge or spoof a clientId parameter when removing a durable topic subscription, bypassing identity verification controls. This requires prior authentication to the broker but no elevated privileges. An attacker with broker access could disrupt legitimate subscriptions, remove subscriptions belonging to other clients, or interfere with message delivery patterns. The issue affects ActiveMQ versions before 5.19.11 and 6.0.0 through 6.3.1; patched versions 5.19.11 and 6.3.2 are available.

Affected products

Apache ActiveMQ before 5.19.11, 6.0.0 through 6.3.1
Apache ActiveMQ Broker before 5.19.11, 6.0.0 through 6.3.1

Timeline

2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.