---
id: CVE-2026-52760
aliases:
  - GHSA-j548-68g5-9j7x
title: >-
  Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site
  Scripting
summary: >-
  Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site
  Scripting
severity: medium
cvss: 6.1
cwe:
  - CWE-79
vendor: apache
product: 'org.apache.activemq:apache-activemq'
ecosystem: maven
affected:
  - 'org.apache.activemq:apache-activemq < 5.19.8'
  - 'org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7'
  - 'org.apache.activemq:activemq-web-console < 5.19.8'
  - 'org.apache.activemq:activemq-web-console >= 6.0.0, < 6.2.7'
patched:
  - 'org.apache.activemq:apache-activemq 5.19.8'
  - 'org.apache.activemq:apache-activemq 6.2.7'
  - 'org.apache.activemq:activemq-web-console 5.19.8'
  - 'org.apache.activemq:activemq-web-console 6.2.7'
published: '2026-06-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T17:35:07Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-j548-68g5-9j7x'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52760'
  - url: 'https://lists.apache.org/thread/d3mhyo2116nomz2lwxppyy4pclvdxq3n'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/29/12'
  - url: 'https://github.com/apache/activemq/pull/2089'
  - url: >-
      https://github.com/apache/activemq/commit/1cbe5ab1122e299852b821ba33e7abd0cd76f77c
  - url: >-
      https://github.com/apache/activemq/commit/90c509f49b88fa71a55020e7ebb5d7264d7804e9
  - url: >-
      https://github.com/apache/activemq/commit/ea5a33ce87a203e0c8335f46f976e0a29c90f18a
  - url: 'https://github.com/apache/activemq/releases/tag/activemq-5.19.8'
  - url: 'https://github.com/apache/activemq/releases/tag/activemq-6.2.7'
  - url: 'https://github.com/advisories/GHSA-j548-68g5-9j7x'
tags:
  - ghsa
  - maven
epss: 0.00679
epssPercentile: 0.52454
ingestedAt: '2026-11-05T18:28:50.458Z'
---

## Overview

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.

The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

## Affected packages

- `org.apache.activemq:apache-activemq < 5.19.8`
- `org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7`
- `org.apache.activemq:activemq-web-console < 5.19.8`
- `org.apache.activemq:activemq-web-console >= 6.0.0, < 6.2.7`

## Remediation

Upgrade to a patched release:

- `org.apache.activemq:apache-activemq 5.19.8`
- `org.apache.activemq:apache-activemq 6.2.7`
- `org.apache.activemq:activemq-web-console 5.19.8`
- `org.apache.activemq:activemq-web-console 6.2.7`