CVE-2026-52760— Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
Quick assessment
Affected
Apache Software Foundation Apache ActiveMQ
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache ActiveMQ是Apache基金会的一款消息队列中间件。 Apache ActiveMQ 5.19.8之前版本和6.0.0至6.2.7之前版本、Apache ActiveMQ Web Console 5.19.8之前版本和6.0.0至6.2.7之前版本存在跨站脚本漏洞，该漏洞源于Web控制台的浏览页面直接渲染消息ID而未进行清理，导致跨站脚本攻击，允许经过身份验证的生产者发送特制JMS消息ID，当管理员浏览队列时，有效载荷在浏览器中执行。以下版本受到影响：Apache ActiveMQ 5
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | < 5.19.8 |
affected |
6.0.0< 6.2.7 |
affected | ||
| Apache Software Foundation | Apache ActiveMQ Web Console | < 5.19.8 |
affected |
6.0.0< 6.2.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-52760
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache ActiveMQ 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache ActiveMQ是Apache基金会的一款消息队列中间件。 Apache ActiveMQ 5.19.8之前版本和6.0.0至6.2.7之前版本、Apache ActiveMQ Web Console 5.19.8之前版本和6.0.0至6.2.7之前版本存在跨站脚本漏洞，该漏洞源于Web控制台的浏览页面直接渲染消息ID而未进行清理，导致跨站脚本攻击，允许经过身份验证的生产者发送特制JMS消息ID，当管理员浏览队列时，有效载荷在浏览器中执行。以下版本受到影响：Apache ActiveMQ 5
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 0 ~ 5.19.8 | - |
|
| Apache Software Foundation | Apache ActiveMQ Web Console | 0 ~ 5.19.8 | - |
|
II. Public POCs for CVE-2026-52760
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-52760
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-52760 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-30 · 10 CVEs total
| CVE-2026-54475 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination owners | |
| CVE-2026-53917 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbo | |
| CVE-2026-53916 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in ST | |
| CVE-2026-50750 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire | |
| CVE-2026-50734 | Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire | |
| CVE-2026-49877 | Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console | |
| CVE-2026-49432 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length | |
| CVE-2026-49434 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instant | |
| CVE-2025-53648 | Apache Gravitino: SQL misconfiguration can access or truncate files |
IV. Related Vulnerabilities
Same product: Apache ActiveMQ
-
CVE-2026-49432
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: -
CVE-2026-49877
Apache ActiveMQ: Authenticated web users retain admin access -
CVE-2026-53916
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: -
CVE-2026-53917
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client -
CVE-2026-42253
Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header I
Same vendor: Apache Software Foundation
-
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure -
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the und -
CVE-2026-71300
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch -
CVE-2026-63621
Apache Camel: Camel-Knative: CloudEvent extension fields rec -
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authenticat
Same weakness: CWE-79
-
CVE-2026-71503
Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administrat -
CVE-2026-30864
Combodo iTop: Reflected XSS in dashboard revert -
CVE-2026-76837
Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Te -
CVE-2026-65053
Horde IMP before 7.2.0 Stored Cross-Site Scripting via Apple -
CVE-2026-78414
Cross-site scripting in Nx Witness VMS Web Administration al
V. Comments for CVE-2026-52760
No comments yet