Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in
    Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id
    directly without sanitization. This allows an authenticated producer to send a message with a JMS message
    ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in
    the Web Console, the payload executes in their browser. This issue affects Apache ActiveMQ: before 5.19.8,
    from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7. Users are
    recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue. (CVE-2026-52760)

The version of Apache ActiveMQ running on the remote host is prior to 5.19.8 or 6.x prior to 6.2.7. It is, therefore, affected by multiple vulnerabilities:

  - Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote     unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a     negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the     per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will     instead force abnormal transport exception handling for the affected connection and closure. (CVE-2026-49432)

  - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache     ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame     with a malicious large size value. The value is not validated and causes the broker to attempt allocation during     pre-auth negotiation which can trigger OOM and crash the broker. (CVE-2026-50734)

  - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default     can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to     only admins. (CVE-2026-49877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in     Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id     directly without sanitization. This allows an authenticated producer to send a message with a JMS message     ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in     the Web Console, the payload executes in their browser. This issue affects Apache ActiveMQ: before 5.19.8,     from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7. Users are     recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue. (CVE-2026-52760)

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in     Apache ActiveMQ, Apache ActiveMQ Web Console.The browse page in the web console renders a message Id     directly without sanitization. This allows an authenticated producer to send a message with a JMS message     ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in     the Web Console, the payload executes in their browser.This issue affects Apache ActiveMQ: before 5.19.8,     from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.Users are     recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue. (CVE-2026-52760)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478568	SCA: security update for org.apache.activemq:activemq-web-console, org.apache.activemq:apache-activemq (GHSA-j548-68g5-9j7x)	Tenable Cloud Security	SCA Checks	Local	medium
478568	SCA: security update for org.apache.activemq:activemq-web-console, org.apache.activemq:apache-activemq (GHSA-j548-68g5-9j7x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
324953	Apache ActiveMQ < 5.19.8 / 6.x < 6.2.7 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high
324302	Linux Distros Unpatched Vulnerability : CVE-2026-52760	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-52760

medium

Tenable Plugins

medium

medium

high

medium