Do Son 
TL;DR
The Apache Software Foundation fixed two Apache ActiveMQ vulnerabilities. One lets a low-privilege user bypass write permissions on protected queues. The other lets a remote attacker crash AMQP connections and starve the broker.
Why it matters
ActiveMQ moves messages between critical business systems. Therefore, broken access control breaks trust across every connected app. Each Apache ActiveMQ vulnerability targets a different layer of the broker. The first hands attackers a path to publish where they should not. Meanwhile, the second threatens uptime for anyone exposing an AMQP port.
How the attacks work
Authorization bypass (CVE-2026-61487)
An authenticated user targets a temporary composite destination. Its physical name lists several real queues, separated by commas. Because the broker treats the destination as temporary, it skips the per-destination write check. As a result, the user publishes to queues that their ACL should block.
AMQP denial of service (CVE-2026-59878)
A remote, unauthenticated peer reaches an exposed AMQP NIO connector. Then it sends a frame with a bad size value. This kills the NIO threads that handle the connection. Sent rapidly, the flood drains the thread pool and denies service to others.
Affected versions
Both issues hit ActiveMQ Broker, ActiveMQ All, and core ActiveMQ. Vulnerable builds run before 5.19.9, plus 6.0.0 through 6.2.7. The AMQP flaw also affects the activemq-amqp package across the same ranges.
Patch and mitigation
Upgrade without delay. Apache recommends version 5.19.9, version 6.2.8, or the newer 6.3.0 release. Until you patch, restrict AMQP connector exposure and tighten network access. So far, no public proof-of-concept and no in-the-wild exploitation have been confirmed for either Apache ActiveMQ vulnerability.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
