CVE-2026-24457CRITICAL 9.1EPSS p48.9%
CVE-2026-24457CVE-2026-24457
eclipse / openmq
Description
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.
Scoring
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| EPSS | 0.64% probability of exploitation · percentile 48.9% · 2026-10-06T12:00:23Z |
| Published | 2026-03-05 |
| Last modified | 2026-08-05 |
Underlying weaknesses· 2
References
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')cwe-22 | 0% | live |
| Weakness | Path Traversal: 'dir/../../filename'cwe-27 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.