CVE-2026-34197highunder attackCWE-20 CWE-78 CWE-94

CVE-2026-34197: high-severity vulnerability in Apache ActiveMQ

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Published 07 Apr 2026 · Updated 17 Aug 2026

93Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 15%

from disclosure to weapon1 days

Published on NVDApr 7

1st PoC+1d

metasploit+22d

CISA KEV+9d

exploitation probability

15%top 3% of all CVEs

observed exploitation

yesCISA + VulnCheck

18 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Not affected

8 products (14 components) — because the vulnerable code is not present in the product

Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Fuse 7 · Red Hat AMQ Broker 7 · Red Hat Data Grid 8 · and others 3

Action required by CISAfederal deadline: 2026-04-30

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Authenticated users of Apache ActiveMQ can execute arbitrary code on the server by exploiting a flaw in how the Jolokia web interface validates commands sent to the broker. An attacker sends a specially crafted network connector configuration that tricks the system into loading and running malicious code from a remote location.

Technical detail

CWE-20 (improper input validation) and CWE-94 (code injection) in Apache ActiveMQ's Jolokia JMX-HTTP bridge (/api/jolokia/) allow authenticated attackers to achieve RCE via BrokerService.addNetworkConnector() or addConnector() operations with a malicious discovery URI. The VM transport's brokerConfig parameter loads a remote Spring XML context through ResourceXmlApplicationContext, which instantiates singleton beans before validation, enabling code execution through bean factory methods. Affects versions before 5.19.4 and 6.0.0–6.2.3.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Software Foundation · Apache ActiveMQ Apache Software Foundation · Apache ActiveMQ All Apache Software Foundation · Apache ActiveMQ Broker

public PoCs found — 18