Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Eclipse Foundation Eclipse OpenMQ — An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H H 9.8 .0062 46.8 —
AFFECTED
Product Versions Fixed
Eclipse OpenMQ unspecified —
Eclipse GlassFish unspecified —
TIMELINE
Jan 23 Reserved by eclipse
Mar 5 Published (CNA: eclipse)
Aug 5 RESCORED — CVE-2026-24457 (Eclipse Foundation Eclipse OpenMQ). CVSS 9.1 → 9.8 (NVD).
Description
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| January 23, 2026 | Reserved | Reserved by eclipse |
| March 5, 2026 | Published | Published (CNA: eclipse) |
| August 5, 2026 | RESCORED | RESCORED — CVE-2026-24457 (Eclipse Foundation Eclipse OpenMQ). CVSS 9.1 → 9.8 (NVD). |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24457 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.