Cyber Resilience

CVE-2026-49270

Medium

Published: 01 June 2026

Published
01 June 2026
Modified
01 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0015 35.8th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-49270 is a medium-severity Exposure of Sensitive Information Through Metadata (CWE-1230) vulnerability in Apache Activemq. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list…

more

of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

CWE(s)
CWE-1230

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1526 Cloud Service Discovery Discovery
An adversary may attempt to enumerate the cloud services running on a system after gaining access.
attack.mitre.org →
Why these techniques?

Unauthenticated remote query to public-facing broker exposes subscription metadata, directly enabling exploitation of public-facing apps (T1190) and cloud/service discovery (T1526).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

apache
activemq
≤ 5.19.7 · 6.0.0 — 6.2.6
apache
activemq broker
≤ 5.19.7 · 6.0.0 — 6.2.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-13 Monitoring for Information Disclosure
addresses: CWE-1230

Identifies sensitive information exposed via metadata during disclosure monitoring.

References