NewsCompaniesFlawsGuides
Get the app
HighFixedUpdated

CVE-2026-40466

When the activemq-http module is present, HTTP discovery can bypass ActiveMQ Classic's original validation fix and let an authenticated attacker run code on the broker.

What to do

Nothing to install on ordinary family phones or computers. If your business or family office runs ActiveMQ Classic, ask IT or the service provider to update to the appropriate current supported release—5.19.12, 6.3.3 or 6.4.0—and check for signs of compromise.

Affects
Apache ActiveMQ Classic message broker
Severity
High
Fixed in
CVE-2026-34197: 5.19.4 and 6.2.3, according to Apache's current advisory.
CVE-2026-40466: 5.19.6 and 6.2.5.
CVE-2026-45505: 5.19.7 and 6.2.6.
Being used in attacks
Not known to be
Made public
6 Apr 2026

Part of: Apache ActiveMQ Classic code-execution flaw CVE-2026-34197 exploited; follow-up bypasses fixed

Apache ActiveMQ Classic, software that passes messages between business applications, had a management-interface flaw that let an authenticated attacker run code on its server. CISA confirmed exploitation by listing CVE-2026-34197 on 16 April. Apache's current advisory identifies 5.19.4 and 6.2.3 as the original fixes, although its initial announcement recommended 5.19.5 on the 5.x branch. Those updates were not the end of the issue: Apache subsequently disclosed two ways around the protection, CVE-2026-40466 and CVE-2026-45505. Fixes for both were available in 5.19.7 and 6.2.6 by 31 May. The reviewed sources do not establish exploitation of either bypass or identify confirmed victims of the original attacks. As of 3 November, fixes are available and Apache offers newer supported releases: 5.19.12, 6.3.3 and 6.4.0. Its 6.2.x branch is inactive.

The whole incident, its timeline and sources

Fixed in the same update

Sources

  1. CVE-2026-34197 announcementApache Software Foundation · 6 Apr 2026
  2. CVE-2026-40466: bypass of CVE-2026-34197 through HTTP discoveryApache Software Foundation · 23 Apr 2026
  3. CVE-2026-45505: Jolokia discovery-wrapper bypassApache Software Foundation · 1 June 2026
  4. Original CVE-2026-34197 announcement on oss-securityApache Software Foundation via oss-security · 6 Apr 2026
  5. Recent Apache ActiveMQ Vulnerability Exploited in the WildSecurityWeek · 17 Apr 2026
  6. Actively exploited Apache ActiveMQ flaw impacts 6,400 serversBleepingComputer · 21 Apr 2026
  7. ActiveMQ release newsApache Software Foundation · 27 Oct 2026
  8. Download ActiveMQ: current releases and branch statusApache Software Foundation · 27 Oct 2026
Also: CVE-2026-40466 at CVE.org · NVD · Every flaw being used in attacks · Everything live