CVE-2020-11998

CVE-2020-11998 is a critical-severity vulnerability in Apache Activemq with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 51% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Frequently asked questions

What is CVE-2020-11998?
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
How severe is CVE-2020-11998?
CVE-2020-11998 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-11998 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 51% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-11998?
CVE-2020-11998 primarily affects Apache Activemq. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-11998?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2020-11998 published?
CVE-2020-11998 was published on 2020-09-10 and last updated on 2026-06-17.

References

Affected products (8)

More vulnerabilities in Apache Activemq

All CVEs affecting Apache Activemq →