CVE-2026-40466
org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 24, 2026
Updated · November 5, 2026
Description
A flaw was found in Apache ActiveMQ. An authenticated attacker can bypass a previous security fix by adding a connector using an HTTP Discovery transport through Jolokia, if the activemq-http module is present. A malicious HTTP endpoint can return a virtual machine (VM) transport, which allows the attacker to load a remote Spring XML application context. This can lead to arbitrary code execution on the broker's Java Virtual Machine (JVM).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-94 · Improper Control of Generation of Code