Eclipse Foundation Eclipse OpenMQ

• CVE-2026-24457 Critical 9.1 An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorize 0.7%
• CVE-2026-22886 Critical 9.8 OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce 0.5%