CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Apache ActiveMQ contains an improper input validation flaw (CWE-20) in the TopicRegion component that manages durable topic subscriptions, affecting all platforms. An authenticated client can spoof another client's clientId when sending a remove-subscription request, causing the broker to delete a durable topic subscription that belongs to a different client. An attacker with valid broker credentials can thereby disrupt other clients' message delivery, since removing a durable subscription can make affected subscribers stop receiving topic messages; the issue is a spoofing/integrity and limited-availability problem, not remote code execution. Users of any of the three distributions (Apache ActiveMQ, ActiveMQ Broker, ActiveMQ All) on versions before 5.19.11 or 6.x from 6.0.0 before 6.3.2 are affected, particularly deployments that accept connections from third-party or multi-tenant authenticated clients. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and CVSS scoring is still pending.

Do: Upgrade to Apache ActiveMQ 5.19.11 on the 5.x line or 6.3.2 on the 6.x line, covering the ActiveMQ, ActiveMQ Broker, and ActiveMQ All distributions. Until patched, restrict broker access to trusted authenticated clients and review which clients are permitted to remove durable topic subscriptions. With no known public PoC or in-the-wild exploitation, this can be prioritized within normal patch cycles unless brokers expose multi-tenant or third-party clients.