How severe is CVE-2026-22886?

CVE-2026-22886 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-22886 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-22886?

CVE-2026-22886 affects Eclipse Openmq. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-22886?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-22886 have an EU (EUVD) identifier?

Yes. CVE-2026-22886 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9283.

When was CVE-2026-22886 published?

CVE-2026-22886 was published on 2026-03-03 and last updated on 2026-06-17.

CVE-2026-22886

CVE-2026-22886 is a critical-severity vulnerability in Eclipse Openmq with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1391.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-9283
Weakness: CWE-1391
Affected product: Eclipse Openmq
Published: 2026-03-03
Last modified: 2026-06-17

Description

OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.

Frequently asked questions

What is CVE-2026-22886?: OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.
How severe is CVE-2026-22886?: CVE-2026-22886 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-22886 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-22886?: CVE-2026-22886 affects Eclipse Openmq. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-22886?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-22886 have an EU (EUVD) identifier?: Yes. CVE-2026-22886 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9283.
When was CVE-2026-22886 published?: CVE-2026-22886 was published on 2026-03-03 and last updated on 2026-06-17.

References

https://gitlab.eclipse.org/security/cve-assignment/-/issues/85

Affected products (1)

cpe:2.3:a:eclipse:openmq:*:*:*:*:*:*:*:*

More vulnerabilities in Eclipse Openmq

CVE-2026-24457 — Critical (CVSS 9.1): An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's…

All CVEs affecting Eclipse Openmq →

Other CWE-1391 vulnerabilities

CVE-2025-67114 — Critical (CVSS 9.8): Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi…
CVE-2025-30519 — Critical (CVSS 9.8): Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through…
CVE-2025-6077 — Critical (CVSS 9.8): Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and…
CVE-2024-51978 — Critical (CVSS 9.8): An unauthenticated attacker who knows the target device's serial number, can generate the default administrator…
CVE-2024-12728 — Critical (CVSS 9.8): A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than…
CVE-2024-43698 — Critical (CVSS 9.8): Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin…

Browse all CWE-1391 vulnerabilities →