VULNERABILITY INTELLIGENCE

CVE-2026-24457

CVSS score9.1 CRITICAL
EPSS probability0.70%
CISA KEVNot currently listed
Published2026-03-05
Last modified2026-08-05
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.

Weakness classification

  • emo@eclipse.org: CWE-22
  • nvd@nist.gov: CWE-22

Primary references