CVE-2026-49157

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

VendorProductVersions
Apache Software FoundationApache ActiveMQ< 5.19.7; >= 6.0.0, < 6.2.6

References

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-491587.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache ThCVE-2026-491596.5Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a nCVE-2026-49162.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 CVE-2026-491607.5Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.CVE-2026-491617.8Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.CVE-2026-491627.0Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-491638.8Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attackeCVE-2026-491649.8Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.CVE-2026-491657.1Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.CVE-2026-491667.8Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-491677.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-491686.8Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack
CVE-2026-49157: High severity, CVSS 8.8 | Vulnix