CVE-2026-74761

Awaiting Analysis Awaiting Analysis - Queue

Client ID Spoofing in Apache ActiveMQ Broker

Publication date: 2026-09-09

Last updated on: 2026-09-18

Assigner: Apache Software Foundation

Description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-18

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-74761

EUVD

EUVD-2026-74829

Affected Vendors & Products

Vendor	Product	Version / Range
apache	activemq	to 5.19.11 (exc)
apache	activemq	From 6.0.0 (inc) to 6.3.2 (exc)
apache	activemq_all	to 5.19.11 (exc)
apache	activemq_all	From 6.0.0 (inc) to 6.3.2 (exc)
apache	activemq_broker	to 5.19.11 (exc)
apache	activemq_broker	From 6.2.0 (inc) to 6.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper input validation in the TopicRegion component of Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All. An authenticated client can spoof the clientId when removing a durable topic subscription, potentially leading to unauthorized actions.

Detection Guidance

This vulnerability involves improper input validation in TopicRegion allowing clientId spoofing during durable topic subscription removal. Detection requires checking ActiveMQ versions and monitoring for suspicious subscription removal activities. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker could exploit this to impersonate legitimate clients, disrupt messaging services, or gain unauthorized access to sensitive data by manipulating durable topic subscriptions.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, potentially violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations must address it to maintain compliance.

Mitigation Strategies

Upgrade Apache ActiveMQ, Apache ActiveMQ Broker, or Apache ActiveMQ All to version 6.3.2 or 5.19.11 or later to address the improper input validation in TopicRegion that allows clientId spoofing during durable topic subscription removal.

Hi! I’m here to help you understand CVE-2026-74761. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70