CVE-2026-49434 Code injection in Apache ActiveMQ
Attackers with LDAP write access can instantiate denied transports and spawn rogue brokers, leading to code execution within the JVM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49434?
CVE-2026-49434 is a high-severity code injection vulnerability in Apache Activemq, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Weakness: CWE-20
Which versions are affected by CVE-2026-49434?
1 open source package ship an affected version, including activemq. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
activemq Bitnami | All versions | 5.19.8, 6.2.7 |
Products include Apache Activemq, Apache Activemq Broker.
How do I fix CVE-2026-49434?
Upgrade activemq to a fixed version for your release line: 5.19.8 or 6.2.7.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-49434 being exploited?
There is no known exploitation of CVE-2026-49434 in the wild and no public exploit code.
Other vulnerabilities in Apache Activemq
Sources
Also known as BIT-activemq-2026-49434, DEBIAN-CVE-2026-49434, GHSA-h5gm-rvw6-2xpx, MINI-5jfg-22qm-c822, MINI-9896-g9x5-w9cm, MINI-cc3c-mq3w-9mfp and 2 more.