CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

High 7.5 Published 9 Sep 2026 Updated 10 Sep 2026

An authenticated attacker can spoof client IDs to remove durable topic subscriptions, potentially disrupting message delivery or causing data loss.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-74761?

CVE-2026-74761 is a high-severity missing authorization vulnerability in Apache Activemq, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

An authenticated client can spoof clientId when removing a durable topic subscription.

This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.

Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Weakness: CWE-20

Which versions are affected by CVE-2026-74761?

1 open source package ship an affected version, including activemq. It affects 3 products.

Package	Affected	Fixed in
`activemq` Bitnami	All versions	`5.19.11, 6.3.2`

Products include Apache Activemq, Apache Activemq All, Apache Activemq Broker.

How do I fix CVE-2026-74761?

Upgrade activemq to a fixed version for your release line: 5.19.11 or 6.3.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-74761 being exploited?

There is no known exploitation of CVE-2026-74761 in the wild and no public exploit code.

All Apache Activemq vulnerabilities

Sources

Also known as BIT-activemq-2026-74761, GHSA-hx9m-72qj-2q46, MINI-7c26-hxmx-4r6h, MINI-8grj-mfmq-fq8x, MINI-jrxp-79f8-9vmj, MINI-mpw6-rvj8-h8rh and 7 more.