CVE-2026-54475Patch(apache / activemq)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache activemq systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

activemq
activemq_broker

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 2d ago at 3 mentions (2026-07-03); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

apache

Products

activemqactivemq_broker

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Patch

350.0%

General

233.3%

Disclosure

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-30	1	General1
2026-07-03	3	Patch3
2026-07-06	1	General1
2026-07-10	1	Disclosure1

Full discourse6 posts

Daily CyberSecurity@the_yellow_fall88d
Patch
Nine Apache ActiveMQ vulnerabilities allow denial of service and a temporary destination takeover (CVE-2026-54475). Upgrade to 6.2.7 now. #ApacheActiveMQ #ActiveMQ #CVE202654475 #DenialOfService #OpenWire #STOMP #MessageBroker #Vulnerability http://securityonline.info/apache-activemq-vulnerabilities-cve-2026-54475/
Post summary
The post highlights nine Apache ActiveMQ CVEs that cause denial of service and temporary destination takeover, and it urges users to upgrade to version 6.2.7 to mitigate the risk.
02020469
12.5K followersView on X
キタきつね@foxbook85d
General
Apache ActiveMQの脆弱性により、サービス拒否攻撃と乗っ取りが可能になる Apache ActiveMQ Vulnerabilities Allow Denial of Service and Takeover #DailyCyberSecurity (Jul 3) https://securityonline.info/apache-activemq-vulnerabilities-cve-2026-54475/
Post summary
The text merely states that a vulnerability in Apache ActiveMQ can lead to denial of service and system takeover, but provides no concrete technical details, PoC, exploit code, active exploitation evidence, or mitigation information.
00020291
5.0K followersView on X
iototsecnews@iototsecnews81d
Disclosure
Apache ActiveMQ の脆弱性 CVE-2026-53917／54475／49877 が FIX：DoS 攻撃やシステム・クラッシュの可能性 https://iototsecnews.jp/2026/07/03/multiple-apache-activemq-vulnerabilities-enable-dos-attacks-and-lead-to-crashes/ 今回の 3 件の深刻な脆弱性は、 Apache ActiveMQ の設計や設定に起因しています。脆弱性 CVE-2026-53917 はメッセージのサイズ検証をしないメモリ割り当てに起因し、システム停止の恐れがあります。 CVE-2026-54475 はサーバ側のチェック不足が原因で、他の接続から一時的なデータが盗まれる危険性があります。 CVE-2026-49877 はデフォルトの設定ミスが原因で、低い権限のユーザーによる管理機能へのアクセスを許してしまいます。これらの問題は、検証の仕組みや、共有環境の分離、権限管理の不備から生じるものです。ご利用のチームは、ご注意ください。 #ActiveMQ #Apache #CVE202649877 #CVE202653917 #CVE202654475 #Vulnerability
Post summary
The article announces three serious Apache ActiveMQ CVEs, detailing their potential impact (DoS, data theft, privilege escalation), but provides no PoC, exploit code, or evidence of active attacks.
00000116
500 followersView on X
TECHEPAGES@techepages87d
Patch
🚨 Three vulnerabilities disclosed in Apache ActiveMQ expose messaging infrastructure to DoS attacks, broken isolation, and unauthorized admin access. Patch now: 🔹 CVE-2026-53917: crafted OpenWire message can crash the broker (OOM) 🔹 CVE-2026-54475: connections can read others' temporary queues 🔹 CVE-2026-49877: low-priv users reach /admin/* in the Web Console 🔹 Fix: upgrade to 5.19.8 or 6.2.7
Post summary
The tweet announces three ActiveMQ CVEs, details their exploits, and urges users to upgrade to patched versions 5.19.8 or 6.2.7.
0000049
23 followersView on X
The Daily Tech Feed@dailytechonx87d
Patch
Apache ActiveMQ users face critical vulnerabilities (CVE-2026-53917, CVE-2026-54475, CVE-2026-49877) leading to DoS attacks and unauthorized access. Immediate updates to versions 6.2.7 or 5.19.8 are essential to secure messaging infrastructures. #ApacheActiveMQ #CyberSecurity #DoS #Vulnerabilities #SecurityUpdate #Messaging https://thedailytechfeed.com/apache-activemq-vulnerabilities-expose-systems-to-dos-and-unauthorized-access/
Post summary
Apache ActiveMQ users must update to 6.2.7 or 5.19.8 to remediate critical DoS and unauthorized access flaws (CVE‑2026‑53917, CVE‑2026‑54475, CVE‑2026‑49877).
0000064
470 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-54475 CVE-2026-54475 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54475
Post summary
The post simply lists CVE-2026-54475 twice and includes a link, with no further details about exploitation, mitigation, or severity.
00000100
4.1K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	activemq	-	-	-
App	apache	activemq_broker	-	-	-

Explore more

Back to dashboard apache CVEs activemq vulnerabilities

What researchers are saying

CVE-2026-54475

キタきつね[verified]@foxbookGeneral

The text merely states that a vulnerability in Apache ActiveMQ can lead to denial of service and system takeover, but provides no concrete technical details, PoC, exploit code, active exploitation evidence, or mitigation information.

TECHEPAGES[verified]@techepagesPatch

The tweet announces three ActiveMQ CVEs, details their exploits, and urges users to upgrade to patched versions 5.19.8 or 6.2.7.

The Daily Tech Feed[verified]@dailytechonxPatch

Apache ActiveMQ users must update to 6.2.7 or 5.19.8 to remediate critical DoS and unauthorized access flaws (CVE‑2026‑53917, CVE‑2026‑54475, CVE‑2026‑49877).

Daily CyberSecurity@the_yellow_fallPatch

The post highlights nine Apache ActiveMQ CVEs that cause denial of service and temporary destination takeover, and it urges users to upgrade to version 6.2.7 to mitigate the risk.

iototsecnews@iototsecnewsDisclosure

The article announces three serious Apache ActiveMQ CVEs, detailing their potential impact (DoS, data theft, privilege escalation), but provides no PoC, exploit code, or evidence of active attacks.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post simply lists CVE-2026-54475 twice and includes a link, with no further details about exploitation, mitigation, or severity.