CVE-2026-46605

Fixed upstream EPSS <1%CVSS 4.3

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Published 2026-06-01 · CVE record · OSV

Products: Apache Software Foundation Apache ActiveMQ Broker, Apache Software Foundation Apache ActiveMQ All, Apache Software Foundation Apache ActiveMQ

Fixed upstream

Distro releases