Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user
    by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not
    limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before
    6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
    (CVE-2026-49877)

The version of Apache ActiveMQ running on the remote host is prior to 5.19.8 or 6.x prior to 6.2.7. It is, therefore, affected by multiple vulnerabilities:

  - Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote     unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a     negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the     per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will     instead force abnormal transport exception handling for the affected connection and closure. (CVE-2026-49432)

  - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache     ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame     with a malicious large size value. The value is not validated and causes the broker to attempt allocation during     pre-auth negotiation which can trigger OOM and crash the broker. (CVE-2026-50734)

  - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default     can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to     only admins. (CVE-2026-49877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user     by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not     limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before     6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
    (CVE-2026-49877)

  - Improper Authorization vulnerability in Apache ActiveMQ.An authenticated low-privilege Web Console user by     default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit     those paths to only admins.This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before     6.2.7.Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue. (CVE-2026-49877)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478350	SCA: security update for org.apache.activemq:apache-activemq (GHSA-f892-4h9f-j7g9)	Tenable Cloud Security	SCA Checks	Local	high
478350	SCA: security update for org.apache.activemq:apache-activemq (GHSA-f892-4h9f-j7g9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324953	Apache ActiveMQ < 5.19.8 / 6.x < 6.2.7 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high
324472	Linux Distros Unpatched Vulnerability : CVE-2026-49877	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-49877

high

Tenable Plugins

high

high

high

high