CVE-2026-49877General(apache / activemq)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache activemq systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

activemq

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 2 classified signals
Peaked 1d ago at 2 mentions (2026-07-03); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

apache

Products

activemq

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

General

250.0%

Patch

250.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-30	1	General1
2026-07-03	2	Patch2
2026-07-10	1	General1

Full discourse4 posts

iototsecnews@iototsecnews81d
General
Apache ActiveMQ の脆弱性 CVE-2026-53917／54475／49877 が FIX：DoS 攻撃やシステム・クラッシュの可能性 https://iototsecnews.jp/2026/07/03/multiple-apache-activemq-vulnerabilities-enable-dos-attacks-and-lead-to-crashes/ 今回の 3 件の深刻な脆弱性は、 Apache ActiveMQ の設計や設定に起因しています。脆弱性 CVE-2026-53917 はメッセージのサイズ検証をしないメモリ割り当てに起因し、システム停止の恐れがあります。 CVE-2026-54475 はサーバ側のチェック不足が原因で、他の接続から一時的なデータが盗まれる危険性があります。 CVE-2026-49877 はデフォルトの設定ミスが原因で、低い権限のユーザーによる管理機能へのアクセスを許してしまいます。これらの問題は、検証の仕組みや、共有環境の分離、権限管理の不備から生じるものです。ご利用のチームは、ご注意ください。 #ActiveMQ #Apache #CVE202649877 #CVE202653917 #CVE202654475 #Vulnerability
Post summary
The piece announces that three Apache ActiveMQ vulnerabilities have been fixed, detailing their technical causes and potential impacts, but provides no PoC, exploit, active‑attack reports, or patch specifics.
00000116
500 followersView on X
TECHEPAGES@techepages88d
Patch
🚨 Three vulnerabilities disclosed in Apache ActiveMQ expose messaging infrastructure to DoS attacks, broken isolation, and unauthorized admin access. Patch now: 🔹 CVE-2026-53917: crafted OpenWire message can crash the broker (OOM) 🔹 CVE-2026-54475: connections can read others' temporary queues 🔹 CVE-2026-49877: low-priv users reach /admin/* in the Web Console 🔹 Fix: upgrade to 5.19.8 or 6.2.7
Post summary
The message announces three ActiveMQ vulnerabilities and immediately recommends upgrading to specific patched versions.
0000049
23 followersView on X
The Daily Tech Feed@dailytechonx88d
Patch
Apache ActiveMQ users face critical vulnerabilities (CVE-2026-53917, CVE-2026-54475, CVE-2026-49877) leading to DoS attacks and unauthorized access. Immediate updates to versions 6.2.7 or 5.19.8 are essential to secure messaging infrastructures. #ApacheActiveMQ #CyberSecurity #DoS #Vulnerabilities #SecurityUpdate #Messaging https://thedailytechfeed.com/apache-activemq-vulnerabilities-expose-systems-to-dos-and-unauthorized-access/
Post summary
Apache ActiveMQ is affected by three CVEs that can cause DoS attacks and unauthorized access; immediate patching to versions 6.2.7 or 5.19.8 is advised.
0000064
470 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
General
CVE-2026-49877 Improper Authorization in Apache ActiveMQ Web Console Admin Paths https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49877
Post summary
The text briefly references CVE-2026-49877, describing it as an improper authorization issue in Apache ActiveMQ Web Console admin paths, and links to a vulnerability details page.
00000103
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	activemq	-	-	-

Explore more

Back to dashboard apache CVEs activemq vulnerabilities

What researchers are saying

CVE-2026-49877

TECHEPAGES[verified]@techepagesPatch

The message announces three ActiveMQ vulnerabilities and immediately recommends upgrading to specific patched versions.

The Daily Tech Feed[verified]@dailytechonxPatch

Apache ActiveMQ is affected by three CVEs that can cause DoS attacks and unauthorized access; immediate patching to versions 6.2.7 or 5.19.8 is advised.

iototsecnews@iototsecnewsGeneral

The piece announces that three Apache ActiveMQ vulnerabilities have been fixed, detailing their technical causes and potential impacts, but provides no PoC, exploit, active‑attack reports, or patch specifics.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text briefly references CVE-2026-49877, describing it as an improper authorization issue in Apache ActiveMQ Web Console admin paths, and links to a vulnerability details page.