CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

As cited

Copy frozen at 2026-09-08 18:07 UTC (site build).

vulnerabilities

CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Apache ActiveMQ versions 5.x before 5.19.11 and 6.x before 6.3.2 contain a moderate-severity vulnerability that allows spoofing of RemoveSubscription clientId. The flaw affects multiple ActiveMQ packages across the broker, all-in-one, and core distributions.

Why it matters: Teams running unpatched ActiveMQ instances should upgrade to 5.19.11, 6.3.2, or later to prevent clientId spoofing attacks that could allow unauthorized subscription removal.

Source published

2026-09-08 15:48 UTC

First seen by Cybersecurity Tracker

2026-09-08 16:31 UTC