CVE-2026-74761

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS probability

0.20%

CWE

CWE-20

Published

2026-09-09

Last modified

2026-09-10

Affected products

• Apache Software Foundation Apache ActiveMQ Broker
• Apache Software Foundation Apache ActiveMQ Broker
• Apache Software Foundation Apache ActiveMQ All
• Apache Software Foundation Apache ActiveMQ All
• Apache Software Foundation Apache ActiveMQ
• Apache Software Foundation Apache ActiveMQ

Weakness type

• CWE-20

Related vulnerabilities

• CVE-2026-3096 — Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
• CVE-2026-13745 — Arbitrary Code Execution in Gemini CLI via Symlinked Environment Variables
• CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
• CVE-2026-86768 — Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
• CVE-2025-71417 — PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
• CVE-2024-58380 — PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
• CVE-2023-54393 — PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
• CVE-2023-54392 — PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

Markdown version · Browse all CVEs