CVE-2026-41043— Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Quick assessment
Affected
Apache Software Foundation Apache ActiveMQ
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache ActiveMQ和Apache ActiveMQ Web都是美国阿帕奇（Apache）基金会的产品。Apache ActiveMQ是一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。Apache ActiveMQ Web是一个提供消息队列管理与监控界面的Web控制组件。 Apache ActiveMQ和Apache ActiveMQ Web存在跨站脚本漏洞，该漏洞源于对Web页面中脚本相关HTML标签的中和不当，可能导致经过身份验证的攻击者通过覆盖内容类
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41043
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.
An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.
This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.
Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache ActiveMQ和Apache ActiveMQ Web 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache ActiveMQ和Apache ActiveMQ Web都是美国阿帕奇（Apache）基金会的产品。Apache ActiveMQ是一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。Apache ActiveMQ Web是一个提供消息队列管理与监控界面的Web控制组件。 Apache ActiveMQ和Apache ActiveMQ Web存在跨站脚本漏洞，该漏洞源于对Web页面中脚本相关HTML标签的中和不当，可能导致经过身份验证的攻击者通过覆盖内容类
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 0 ~ 5.19.6 | - |
|
| Apache Software Foundation | Apache ActiveMQ Web | 0 ~ 5.19.6 | - |
|
II. Public POCs for CVE-2026-41043
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41043
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-04-24 · 7 CVEs total
| CVE-2026-40466 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026- | |
| CVE-2026-41044 | Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perfo | |
| CVE-2025-62233 | Apache DolphinScheduler: Deserialization of untrusted data in RPC | |
| CVE-2026-23902 | Apache DolphinScheduler: Users are able to use tenants that are not defined on the platfor | |
| CVE-2026-40690 | Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated t | |
| CVE-2026-38743 | Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities |
IV. Related Vulnerabilities
Same product: Apache ActiveMQ
-
CVE-2026-49432
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: -
CVE-2026-49877
Apache ActiveMQ: Authenticated web users retain admin access -
CVE-2026-52760
Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via -
CVE-2026-53916
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: -
CVE-2026-53917
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-79
-
CVE-2026-105220
Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via -
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105224
YesWiki before 4.6.7 Stored XSS via Bazar valeur Action -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-103344
WordPress Unlimited Elements For Elementor (Free Widgets, Ad
V. Comments for CVE-2026-41043
No comments yet