Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-34197GHSA-RXPJ-7QVF-XV32BIT-ACTIVEMQ-2026-34197

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ before 5.19.4, and 6.0.0 before 6.2.3, are affected when the Jolokia bridge is exposed on the web console. Fixed in 5.19.4 and 6.2.3.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 5.19.4, 6.2.3, 5.19.5
None on Exploit-DB, Metasploit or GitHub

Summary

Apache ActiveMQ Classic (the Broker, All, and core ActiveMQ packages) is affected. An authenticated user can abuse the built-in web console management interface to make the broker load a remote configuration and run arbitrary code on the server, giving them full control over the affected system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • org.apache.activemq:activemq-broker

    fixed in 5.19.4; From 6.0.0 · fixed in 6.2.3

  • org.apache.activemq:activemq-all

    fixed in 5.19.4; From 6.0.0 · fixed in 6.2.3

  • org.apache.activemq:apache-activemq

    fixed in 5.19.4; From 6.0.0 · fixed in 6.2.3

  • org.apache.activemq:activemq-brokerMaven

    fixed in 5.19.5

  • org.apache.activemq:activemq-brokerMaven

    From 6.0.0 · fixed in 6.2.3

  • org.apache.activemq:activemq-allMaven

    fixed in 5.19.5

  • org.apache.activemq:activemq-allMaven

    From 6.0.0 · fixed in 6.2.3

References 1

activemq.apache.org

FAQ

Questions about CVE-2026-34197

What does this mean?

The Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console lets authenticated users call bean factory methods such as Runtime.exec(). This allows arbitrary code execution on the broker's JVM.Source: activemq.apache.org

Am I affected, and how do I check?

Affected versions are Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ before 5.19.4, plus 6.0.0 before 6.2.3. The Jolokia bridge must be exposed on the web console at /api/jolokia/, so check the installed version and whether that path is reachable.Source: activemq.apache.org

What should I do about it?

Upgrade to ActiveMQ 5.19.4 or 6.2.3, which fixes the issue.Source: activemq.apache.org

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-16, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data