CVE-2026-45505

Estado: AnalizadaAlta (8.8)—

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.

Original description from CVE-2026-34197.

Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Leer descripción completaMostrar menos

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.88%
Percentil entre todas las CVEs puntuadas: 58
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement92 %
Impacto principalT1059 Command and Scripting Interpreterexecution95 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation78 %

Vulnerabilidad en Apache ActiveMQ que requiere autenticación (PR:L) y acceso de red; explotación remota de servicio. Permite ejecución arbitraria de código mediante inyección en ResourceXmlApplicationContext y escalada a privilegios del broker.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Privileged Account Management Execution Prevention Disable or Remove Feature or Program Application Isolation and Sandboxing Exploit Protection

Tecnologías afectadas (2)

Apache — Activemq Apache — Activemq Broker

CWE

CWE-20, CWE-94

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-45505",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45505",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-01T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ Broker",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.19.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.2.6",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.activemq:activemq-broker",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ All",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.19.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.2.6",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.activemq:activemq-all",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.19.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.2.6",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.activemq:apache-activemq",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-01T09:16:19.700",
  "references": [
    {
      "url": "https://lists.apache.org/thread/7n97nddyw96w6ykldjv1h40jx86xdo0w",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34197",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\n\nNon-parenthesized discovery wrappers such as `masterslave:vm://...,...`\nand `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197. \n\nOriginal description from CVE-2026-34197.\n\nApache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). \nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Validación de entrada incorrecta, Control incorrecto de la generación de código ('Inyección de Código') vulnerabilidad en Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\nLos envoltorios de descubrimiento sin paréntesis, como 'masterslave:vm://...,...' y 'static:vm://...', pasan incorrectamente la validación, lo que permite eludir la corrección en CVE-2026-34197.\n\nDescripción original de CVE-2026-34197.\n\nApache ActiveMQ expone el puente Jolokia JMX-HTTP en /api/jolokia/ en la consola web. La política de acceso predeterminada de Jolokia permite operaciones exec en todos los MBeans de ActiveMQ (org.apache.activemq:*), incluyendo BrokerService.addNetworkConnector(String) y BrokerService.addConnector(String). Un atacante autenticado puede invocar estas operaciones con una URI de descubrimiento manipulada que activa el parámetro brokerConfig del transporte VM para cargar un contexto de aplicación Spring XML remoto utilizando ResourceXmlApplicationContext. Debido a que ResourceXmlApplicationContext de Spring instancia todos los beans singleton antes de que BrokerService valide la configuración, se produce la ejecución de código arbitrario en la JVM del broker a través de métodos de fábrica de beans como Runtime.exec().\nEste problema afecta a Apache ActiveMQ Broker: anterior a 5.19.7, desde 6.0.0 anterior a 6.2.6; Apache ActiveMQ All: anterior a 5.19.7, desde 6.0.0 anterior a 6.2.6; Apache ActiveMQ: anterior a 5.19.7, desde 6.0.0 anterior a 6.2.6.\n\nSe recomienda a los usuarios actualizar a la versión 5.19.7 o 6.2.6, que corrige el problema."
    }
  ],
  "lastModified": "2026-07-21T19:10:00.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
              "versionEndExcluding": "5.19.7"
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE27E832-0E65-4D05-A2EE-271152799E96",
              "versionEndExcluding": "5.19.7"
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94F0DB6E-BEF4-4BEB-92F5-3A7B65172CC2",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}