CVE-2026-49157

highCVSS 8.8covered by 1 sourcefirst seen 2026-06-01

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

⚡ Watch CVE-2026-49157

Get an email if CVE-2026-49157 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.

Advisory coverage (1)

highGHSA-99qx-5qqr-4j95: Apache ActiveMQ has an Incorrect Default Permissions vulnerabilityghsa · 2026-06-01

External references

NVD record for CVE-2026-49157

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-49157 status](https://www.csirts.com/badge/CVE-2026-49157)](https://www.csirts.com/cve/CVE-2026-49157)