The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a high-severity Apache ActiveMQ vulnerability as actively exploited in attacks. The flaw remained undetected for 13 years before patching earlier this month.
CISA added the Apache ActiveMQ vulnerability to its Known Exploited Vulnerabilities catalog, indicating attackers have already deployed working exploits in real-world campaigns.
The flaw affects ActiveMQ, a widely-used open-source message broker deployed across enterprises for managing data transmission between applications. Its 13-year window without detection underscores the risks posed by vulnerabilities in critical infrastructure software.
Apache released patches earlier this month after the vulnerability's discovery. Organizations running affected versions face immediate risk and should prioritize updates.
ActiveMQ's prevalence in enterprise environments—including financial services, healthcare, and government sectors—amplifies the threat level. The active exploitation status suggests attackers are scanning networks for unpatched instances.
CISA's catalog listing serves as a formal alert to federal agencies and critical infrastructure operators. The agency typically recommends immediate patching for vulnerabilities with confirmed active exploitation.
The incident highlights a persistent challenge in open-source software security: vulnerabilities can persist undetected for years before discovery, leaving legacy systems exposed. Organizations relying on older versions of widely-used tools face elevated risk during the window between public disclosure and patch deployment.
Administrators should verify their ActiveMQ versions against Apache's security advisory and apply updates immediately. Network monitoring for suspicious ActiveMQ traffic patterns may help identify compromise attempts.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.