CVE-2026-41043

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

How to fix CVE-2026-41043

To remediate CVE-2026-41043, upgrade the affected package to a fixed version below.

• —upgrade to 5.19.6 or later
• —no fix listed
• —upgrade to 5.19.6 or later
• —upgrade to 5.19.6 or later
• —upgrade to 5.19.6 or later

Is CVE-2026-41043 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 5.19.6, >= 6.0.0, < 6.2.5
• from 0
• from 0, < 5.19.6
• from 0, < 5.19.6
• from 0, < 5.19.6

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-41043
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-41043
• PATCHgithub.com/apache/activemq
• WEBactivemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt