CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Apache ActiveMQ CVE-2026-74761: moderate clientId spoofing in RemoveSubscription handling, affecting Broker, All and apache-activemq, fixed in 6.3.2 and 5.19.11.
The Apache ActiveMQ team disclosed CVE-2026-74761, a moderate-severity spoofing issue in the handling of RemoveSubscription clientId. Affected components include ActiveMQ Broker (activemq-broker), ActiveMQ All (activemq-all) and Apache ActiveMQ in versions 6.0.0 before 6.3.2 and 5.x before 5.19.11. The flaw could allow a client to spoof another client's clientId when removing subscriptions. Users should upgrade to the 6.3.2 or 5.19.11 release lines or later.
- CVE-2026-74761 rated moderate by the Apache ActiveMQ team
- Affects activemq-broker, activemq-all and apache-activemq distributions
- Patched releases include 6.3.2 and 5.19.11
- CVEs
- CVE-2026-74761
- Vendors
- Apache Software Foundation
- Products
- Apache ActiveMQ
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74761 | Improper input validation in Apache ActiveMQ allows clientId spoofing | 7.5 | <1% |
From the original article
Posted by Matt Pavlovich on Sep 08 Severity: moderate Affected versions: - Apache ActiveMQ Broker (org. apache. activemq:activemq-broker) 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.