CVE-2026-74761

HighCVSS 7.5/10Last modified Sep 18, 2026

Description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

An authenticated client can spoof clientId when removing a durable topic subscription.

This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.

Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Apache Software FoundationApache ActiveMQ Broker>= 6.0.0, < 6.3.2; < 5.19.11
Apache Software FoundationApache ActiveMQ All>= 6.0.0, < 6.3.2; < 5.19.11
Apache Software FoundationApache ActiveMQ>= 6.0.0, < 6.3.2; < 5.19.11

References

Timeline

Published
Sep 9, 2026
Last modified
Sep 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-7476410.0Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the exCVE-2026-747656.5Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycoCVE-2026-747668.4Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the outpuCVE-2026-747678.7Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO imCVE-2026-747684.1Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A hCVE-2026-747696.5Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileCVE-2026-74777.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture KCVE-2026-747708.8Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS CommanCVE-2026-747716.5Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileCVE-2026-747747.5Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker wiCVE-2026-747837.5Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deepCVE-2026-747848.7Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries withou
CVE-2026-74761: High severity, CVSS 7.5 | Vulnix