The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in     Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix     in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via     BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is     on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will     bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig     parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because     Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates     the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such     as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5;
    Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0     before 6.2.5. Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.
    (CVE-2026-40466)

  - Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in     Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.An authenticated attacker may bypass the fix     in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via     BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is     on the classpath.A malicious HTTP endpoint can return a VM transport through the HTTP URI which will     bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig     parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.Because     Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates     the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such     as Runtime.exec().This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5;
    Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0     before 6.2.5.Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.
    (CVE-2026-40466)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-40466

high Nessus Plugin ID 310126

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.5 May 5, 2026, 5:46 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605050546
Version 1.3 Apr 29, 2026, 12:50 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604291250
Version 1.2 Apr 27, 2026, 11:43 AM CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202604271143
Version 1.1 Apr 24, 2026, 4:28 PM New Plugin Feed: 202604241628