Summary
| Vulnerability Name | Remote Code Execution in Apache ActiveMQ (CVE-2026-40466) |
| Released on | April 24, 2026 |
| Affected Component | Apache ActiveMQ |
| Affected Version | Apache ActiveMQ < 5.19.6 6.0.0 ≤ Apache ActiveMQ < 6.2.5 Apache ActiveMQ Broker < 5.19.6 6.0.0 ≤ Apache ActiveMQ Broker < 6.2.5 Apache ActiveMQ All < 5.19.6 6.0.0 ≤ Apache ActiveMQ All < 6.2.5 |
| Vulnerability Type | Code execution |
| Exploitation Condition | 1. User authentication: required. 2. Preconditions: default configurations. 3. Trigger mode: remote. |
| Impact | Exploitation difficulty: difficult. Only authenticated users can exploit this vulnerability. Severity: critical. This vulnerability can result in remote code execution. |
| Official Solution | Available |
About the Vulnerability
Component Introduction
Apache ActiveMQ is the most popular open-source, multi-protocol, Java-based message broker. It supports industry-standard protocols, which enable users to take advantage of a variety of client options across a wide range of languages and platforms, including JavaScript, C, C++, Python, .NET, etc.
Vulnerability Description
On April 24, 2026, Sangfor FarSight Labs received notification of the remote code execution vulnerability in Apache ActiveMQ (CVE-2026-40466), classified as critical in threat level.
Specifically, Apache ActiveMQ contains a remote code execution vulnerability stemming from the improper input validation and improper control of code generation in Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ. If the activemq-http module is on the classpath, an authenticated attacker can bypass the fix in CVE-2026-34197 by adding a connector by using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia. A malicious HTTP endpoint can return a VM transport through the HTTP URI to bypass the validation added in CVE-2026-34197. Then, the attacker can use the brokerConfig parameter in the VM transport to load a remote Spring XML application context by using ResourceXmlApplicationContext.
Affected Versions
The following Apache ActiveMQ versions are affected:
Apache ActiveMQ < 5.19.6
6.0.0 ≤ Apache ActiveMQ < 6.2.5
Apache ActiveMQ Broker < 5.19.6
6.0.0 ≤ Apache ActiveMQ Broker < 6.2.5
Apache ActiveMQ All < 5.19.6
6.0.0 ≤ Apache ActiveMQ All < 6.2.5
Solutions
Remediation Solutions
Official Solutions
The latest versions have been officially released to fix the vulnerability. Affected users are advised to update Apache ActiveMQ to the latest versions as needed.
Download link: https://activemq.apache.org/download.html
Temporary Solutions
- Disable unused functional modules to reduce attack entry points.
- Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
- Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
- Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.
Sangfor Solutions
Proactive Vulnerability Detection
The following Sangfor services can proactively detect CVE-2026-40466 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:
- Athena Managed Detection and Response (MDR): The corresponding detection solution will be released on May 30, 2026. The rule ID is SF-2026-01015.
- Athena Extended Detection and Response (XDR): The corresponding detection solution will be released on April 26, 2026. The rule ID is SF-2026-00904.
Vulnerability Monitoring
The following Sangfor services support CVE-2026-40466 vulnerability monitoring, and can quickly identify affected assets and the impact scope in business scenarios in real time through traffic collection:
- Athena Network Detection and Response (NDR): The corresponding monitoring solution will be released on May 08, 2026. The rule ID is 11220422.
- Athena MDR: The corresponding monitoring solution will be released on May 08, 2026. The rule ID is 11220422. In this case, make sure that Athena MDR is integrated with Athena NDR.
- Athena XDR: The corresponding monitoring solution will be released on May 08, 2026. The rule ID is 11220422.
Vulnerability Prevention
The following Sangfor services can effectively block CVE-2026-40466 exploits:
- Athena Next-Generation Firewall (NGFW): The corresponding prevention solution will be released on May 08, 2026. The rule ID is 11220422.
- Sangfor Web Application Firewall (WAF): The corresponding prevention solution will be released on May 08, 2026. The rule ID is 11220422.
- Athena MDR: The corresponding prevention solution will be released on May 08, 2026. The rule ID is 11220422. In this case, make sure that Athena MDR is integrated with Athena NGFW.
- Athena XDR: The corresponding prevention solution will be released on May 08, 2026. The rule ID is 11220422. In this case, make sure that Athena XDR is integrated with Athena NGFW.
Timeline
On April 24, 2026, Sangfor FarSight Labs received notification of the remote code execution vulnerability in Apache ActiveMQ (CVE-2026-40466).
On April 24, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
https://seclists.org/oss-sec/2026/q2/207
Learn More
Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.
