As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Apache ActiveMQ and ActiveMQ Runtime Config contain an improper invalidation of cached authorizations vulnerability that allows write access to persist after a principal's permissions are revoked. Affected versions include ActiveMQ 6.0.0 before 6.3.3, versions before 5.19.12, and corresponding Runtime Config versions. The issue stems from cached authorization data not being invalidated when access controls are modified.
Why it matters: Organizations running affected ActiveMQ versions face unauthorized write access to message queues even after revoking permissions; administrators must upgrade to patched versions (6.3.3 or 5.19.12 and later) immediately to enforce access revocations.
- Source published
- First seen by Cybersecurity Tracker