The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in     Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin     web console page to construct a malicious broker name that bypasses name validation to include an xbean     binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can     then use the DestinationView mbean to send a message to trigger a VM transport creation that will     reference this malicious broker name which can lead to loading the malicious Spring XML context file.
    Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService     validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory     methods such as Runtime.exec(). This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before     6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6,     from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the     issue. (CVE-2026-41044)

  - Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in     Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.An authenticated attacker can use the admin     web console page to construct a malicious broker name that bypasses name validation to include an xbean     binding that can be later used by a VM transport to load a remote Spring XML application.The attacker can     then use the DestinationView mbean to send a message to trigger a VM transport creation that will     reference this malicious broker name which can lead to loading the malicious Spring XML context     file.Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the     BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through     bean factory methods such as Runtime.exec().This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0     before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before     5.19.6, from 6.0.0 before 6.2.5.Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes     the issue. (CVE-2026-41044)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-41044

high Nessus Plugin ID 310128

Version 1.5