CVE-2026-74761

🟡 Monitoruj

Nieprawidłowa walidacja wejścia w Apache ActiveMQ pozwala uwierzytelnionemu klientowi na spoofing clientId.

CVSS

7.5

EPSS

0.4%

Exploit

none

Vendor

apache

Opis źródłowy (NVD)

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

brak Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	7.5
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	0.4%
Opublikowano (NVD)	2026-09-09 12:17:13 UTC
Ostatnia modyfikacja (NVD)	2026-09-18 14:37:42 UTC

Referencje

https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz ([email protected]) [Mailing List, Vendor Advisory]
http://www.openwall.com/lists/oss-security/2026/09/08/12 (af854a3a-2127-422b-91ae-364da2661108) [Mailing List]