CVE-2026-22886: Critical severity Oracle OpenMQ vulnerability
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement.
In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22886?
CVE-2026-22886 has a high severity level due to the default credentials and lack of mandatory password change.
How do I mitigate CVE-2026-22886?
To mitigate CVE-2026-22886, immediately change the default admin credentials after installation and enable stricter authentication policies.
Which versions of OpenMQ are affected by CVE-2026-22886?
All versions of Oracle OpenMQ that ship with the default administrative account are affected by CVE-2026-22886.
Is it safe to use OpenMQ with the default admin account?
Using OpenMQ with the default admin account is not safe and poses a significant security risk.
What are the consequences of not addressing CVE-2026-22886?
Failing to address CVE-2026-22886 can lead to unauthorized access to the management interface, compromising the security of the OpenMQ system.