CVE-2026-74761: 
Apache ActiveMQ Classic vulnerability analysis and mitigation

CVE-2026-74761 is an improper input validation vulnerability in the TopicRegion component of Apache ActiveMQ that allows an authenticated client to spoof a clientId when removing a durable topic subscription. It affects Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms — specifically versions before 5.19.11 and versions 6.0.0 through before 6.3.2. The vulnerability was disclosed on September 8, 2026, by reporter Wanxin Yin, with patches released on September 8–12, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Apache Advisory, GitHub Advisory).

The root cause is improper input validation (CWE-20) in the TopicRegion class of the Apache ActiveMQ broker, which fails to verify that the clientId supplied in a RemoveSubscription request matches the authenticated client's actual identity. An authenticated attacker can craft a RemoveSubscription message with an arbitrary clientId, causing the broker to remove a durable topic subscription belonging to a different client. Exploitation requires network access to the broker and valid credentials, but no elevated privileges beyond basic authentication. No public proof-of-concept code has been identified at this time (oss-security, GitHub Advisory).

Successful exploitation allows an authenticated attacker to remove durable topic subscriptions belonging to other clients, resulting in unauthorized modification of subscription states and potential disruption of message delivery for affected consumers. The impact is primarily an integrity violation — there is no confidentiality or availability impact per the CVSS scoring. In environments where reliable message delivery is critical (e.g., financial or operational systems), disruption of durable subscriptions could cause significant business process failures (Apache Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.197% (0.00197), indicating a low near-term exploitation probability. However, the attack is classified as automatable with no user interaction required beyond authentication, which lowers the barrier for abuse (GitHub Advisory).

1. Reconnaissance: Identify Apache ActiveMQ broker instances (versions before 5.19.11 or 6.0.0–6.3.1) exposed on the network, typically listening on port 61616 (OpenWire protocol) or other configured transport ports.
2. Obtain credentials: Acquire valid broker credentials through phishing, credential reuse, or other means — any authenticated account is sufficient.
3. Connect to the broker: Establish an authenticated connection to the ActiveMQ broker using a standard ActiveMQ client library (e.g., Java ActiveMQ client) with the obtained credentials.
4. Craft a spoofed RemoveSubscription request: Construct a RemoveSubscription command with a clientId set to the target victim client's identifier rather than the attacker's own clientId.
5. Send the malicious request: Transmit the crafted message to the broker's TopicRegion. Due to missing input validation, the broker accepts the spoofed clientId and removes the victim's durable subscription.
6. Impact: The targeted client's durable subscription is deleted, causing it to miss messages published while the subscription was absent, disrupting message delivery (oss-security, GitHub Advisory).

• Network: Unexpected RemoveSubscription commands observed on the ActiveMQ broker transport port (default 61616) from clients that do not own the targeted subscription's clientId.
• Logs: ActiveMQ broker logs showing RemoveSubscription events where the requesting client's authenticated identity does not match the clientId in the request; look for log entries in activemq.log referencing subscription removal for clientId values inconsistent with the connected session.
• Application Behavior: Consumers reporting missed messages or unexpected loss of durable subscriptions without having issued an unsubscribe themselves; monitoring alerts for durable subscriber count drops not correlated with legitimate client disconnections.

Apache has released fixed versions 6.3.2 and 5.19.11 that address this vulnerability by properly validating the clientId in RemoveSubscription requests. Users should upgrade to one of these versions immediately. As a temporary workaround, restrict access to the ActiveMQ broker to only trusted, authenticated users and implement network segmentation to limit exposure of broker transport ports to untrusted networks (Apache Advisory, oss-security).

The vulnerability was reported by researcher Wanxin Yin and disclosed via the Apache security mailing list and oss-security on September 8, 2026. The Apache Software Foundation classified the severity as "moderate" in the oss-security announcement, though the CVSS score of 7.5 places it in the "High" category. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (oss-security, Apache Advisory).