GHSA-wqfh-9m4g-7x6x · Severity: critical · Ecosystem: maven — Remote code execution in Apache ActiveMQ
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Conclusion & alert: CVE-2020-11998 is rated High Risk (78.8/100): CVSS Critical severity, with high exploitation likelihood (EPSS 51.23%, 99th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +44.31% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 6.91% | 51.23% | +44.31% |
| 2 | 2026-02-27 | 8.03% | 6.91% | -1.12% |
| 3 | 2025-11-21 | — | 8.03% | — |
Full EPSS history (25 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
GHSA-wqfh-9m4g-7x6x · Severity: critical · Ecosystem: maven — Remote code execution in Apache ActiveMQ
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2020-11998 unimportant priority: Debian including 1 source packages (activemq), 4 status rows across 4 suites (bookworm, bullseye, sid, trixie): resolved 4. | https://security-tracker.debian.org/tracker/CVE-2020-11998 |
ubuntu
|
medium | CVE-2020-11998 medium priority: Ubuntu including 1 source packages (activemq), 16 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): ignored 8, needs-triage 7, DNE 1. | https://ubuntu.com/security/CVE-2020-11998 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | activemq | 5.15.12 | cpe:2.3:a:apache:activemq:5.15.12:*:*:*:*:*:*:* |
| oracle | communications_diameter_signaling_router | >= 8.0.0, <= 8.5.0 | cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* |
| oracle | communications_element_manager | >= 8.2.0, <= 8.2.4.0 | cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* |
| oracle | communications_session_report_manager | >= 8.0.0, <= 8.2.2 | cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* |
| oracle | communications_session_route_manager | >= 8.0.0, <= 8.2.2 | cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* |
| oracle | enterprise_repository | 11.1.1.7.0 | cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* |
| oracle | flexcube_private_banking | 12.0.0 | cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* |
| oracle | flexcube_private_banking | 12.1.0 | cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* |