🟠HIGH
Severity Overview
- CVSS Base Score: 8.8
- Severity: HIGH
- CVSS Version: 3.1
- Priority: High priority
Summary
Improper Input Validation, Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport’s brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring’s ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker’s JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.
Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
Analyst Takeaway
This vulnerability is already in CISA KEV, which means exploitation has been observed in the wild and the issue should be treated as active risk rather than theoretical exposure. The CVSS score is high enough to justify expedited remediation, especially for exposed systems or assets that handle sensitive data. Apache ActiveMQ is associated with technology that is commonly deployed in enterprise environments, so defenders should assume a higher probability of broad target interest and prioritize validation across the environment. The ATT&CK mapping suggests public-facing exploitation risk, so external exposure validation should be part of immediate triage. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.
MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application
Rationale: The product appears likely to be internet-facing or commonly exposed in enterprise environments.
Detection Guidance
-
T1190 – Exploit Public-Facing Application
- Inspect web server, reverse proxy, load balancer, and WAF logs for abnormal requests.
- Look for unusual requests to uncommon URIs, exploit strings, or suspicious POST activity.
- Monitor for spikes in HTTP 4xx/5xx responses that may indicate probing or failed exploitation attempts.
- Review outbound connections from affected servers for unexpected command-and-control or secondary payload retrieval.
- Validate which internet-facing assets are running the vulnerable product and whether compensating controls exist.
Hunting Considerations
- Search SIEM and EDR data for activity aligned to the mapped ATT&CK techniques.
- Correlate endpoint, network, identity, and application telemetry for signs of exploitation and post-exploitation behavior.
- Prioritize internet-facing systems, externally reachable management interfaces, and assets handling sensitive data.
- Investigate unexpected process creation, service changes, outbound connections, or authentication anomalies on affected hosts.
Key Details
- CVE: CVE-2026-34197
- Vendor: Apache
- Product: ActiveMQ
- CWE: CWE-20
- Date Added to CISA KEV: 2026-04-16
- CISA Due Date: 2026-04-30
- Known Ransomware Campaign Use: Unknown
Technical Severity Details
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Why This Matters
This vulnerability is included in CISA’s Known Exploited Vulnerabilities catalog, which means exploitation has been observed in the wild. Based on the available NVD scoring, this issue should be treated as high priority.
Recommended Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197