Product by Apache Software Foundation
Apache ActiveMQ
77 known vulnerabilities in Apache ActiveMQ (Apache Software Foundation), 3 of them actively exploited (CISA KEV).
Key figures
77
Vulnerabilities
3
Actively exploited (KEV)
1
Used by ransomware
14
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2016-3088 | Apache ActiveMQ Improper Input Validation Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2013-7285 | Xstream: security vulnerability | 9.8 | |
| High | CVE-2022-41678 | Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE | 8.8 | |
| Critical | CVE-2020-11998 | Apache ActiveMQ: Code Execution | 9.8 | |
| High | CVE-2026-40466 | Apache ActiveMQ Broker: Code Injection | 8.8 | |
| Critical | CVE-2015-5254 | Apache ActiveMQ: Code Execution | 9.8 | |
| Critical | CVE-2014-3600 | Apache ActiveMQ: XML External Entity (XXE) | 9.8 | |
| High | CVE-2024-32114 | Apache ActiveMQ: Jolokia and REST API were not secured with default configuration | 8.5 | |
| High | CVE-2020-26217 | Remote Code Execution in XStream | 8.0 | |
| High | CVE-2025-27533 | Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation | 7.5 | |
| High | CVE-2021-21341 | XStream can cause a Denial of Service | 7.5 | |
| High | CVE-2014-3576 | Apache ActiveMQ: Denial of Service | 7.5 | |
| High | CVE-2019-0222 | Apache ActiveMQ: security vulnerability | 7.5 | |
| High | CVE-2021-26117 | ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind | 7.5 | |
| Medium | CVE-2020-13947 | Apache ActiveMQ: Cross-Site Scripting (XSS) | 6.1 | |
| Critical | CVE-2021-21346 | XStream is vulnerable to an Arbitrary Code Execution attack | 6.1 | |
| Medium | CVE-2018-8006 | Apache ActiveMQ: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2021-21349 | Xstream: Deserialization of Untrusted Data | 6.1 | |
| Critical | CVE-2021-21345 | XStream is vulnerable to a Remote Command Execution attack | 5.8 | |
| High | CVE-2018-11775 | Apache ActiveMQ: security vulnerability | 7.4 | |
| Critical | CVE-2021-21351 | XStream is vulnerable to an Arbitrary Code Execution attack | 5.4 | |
| Critical | CVE-2021-21344 | XStream is vulnerable to an Arbitrary Code Execution attack | 5.3 | |
| Critical | CVE-2021-21347 | XStream is vulnerable to an Arbitrary Code Execution attack | 6.1 |
News
- Human oversight is still critical as AI patching tools miss security riskscsoonline,
- Frontier LLMs Generate Flawed Patchessans-newsbites-mail,
- Healthcare Software Company ChipSoft Suffers Ransomware Attacksans-newsbites-mail,
- (g+) ActiveMQ Jolokia Code-Injection: Schwachstelle Message Brokergolem-security