VulnSocial
← Back to blog

CVE-2026-34197 – High Severity Remote Code Execution in Apache ActiveMQ Classic

Key takeaways

  • CVE-2026-34197 is a High severity remote code execution flaw in Apache ActiveMQ Classic.
  • The vulnerability is under active exploitation and has been added to CISA KEV with a remediation deadline of 2026‑04‑30.
  • Any instance exposing the Jolokia JMX‑HTTP bridge (/api/jolokia/) is at risk.
  • Immediate patch to 5.19.4 or 6.2.3 (or later) is required; otherwise apply strict network controls and disable exec operations.

Overview

The CVE-2026-34197 vulnerability was disclosed on 2026‑04‑07 and quickly entered the public domain. It is rated High with a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw allows an attacker to achieve remote code execution (RCE) on the Java Virtual Machine hosting the broker. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026‑04‑16, setting a mandatory remediation deadline of 2026‑04‑30. Since then, multiple reports indicate active exploitation in the wild, with a spike of 54 exploitation events on 2026‑04‑17 alone.

Technical Details

The vulnerability resides in the Jolokia JMX‑HTTP bridge exposed at /api/jolokia/ on the ActiveMQ web console. By default, Jolokia’s access policy allows the exec operation on all ActiveMQ MBeans (pattern org.apache.activemq:*). An attacker can invoke the MBean operations BrokerService.addNetworkConnector(String) or BrokerService.addConnector(String) with a crafted discovery URI that triggers the VM transport’s brokerConfig parameter. This parameter loads a remote Spring XML application context via ResourceXmlApplicationContext. Because Spring instantiates all singleton beans before the broker validates the configuration, malicious bean definitions can execute arbitrary OS commands through methods such as Runtime.exec().

In short, the attack flow is:

  1. Send an HTTP request to /api/jolokia/ with an exec operation targeting an ActiveMQ MBean.
  2. Provide a discovery URI that points to a malicious Spring XML file (e.g., vm://localhost?brokerConfig=.../malicious.xml).
  3. The VM transport loads the remote XML, Spring creates the beans, and the attacker‑controlled bean executes Runtime.exec(), achieving RCE on the broker’s JVM.

The flaw is classified under CWE-20 (Improper Input Validation) and CWE-94 (Improper Control of Generation of Code – Code Injection).

Severity & Impact

MetricValue
SeverityHigh
CVSS Base Score8.8
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ImpactRemote Code Execution (full system compromise)
CWECWE-20, CWE-94

Affected Products

The flaw affects all Apache ActiveMQ Classic installations running versions prior to 5.19.4 and 6.0.0 up to but not including 6.2.3. This includes the ActiveMQ Broker component. For a complete list of affected CPE entries and version ranges, see the detailed inventory on the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2026-34197.

Actionable Insights

  • Inventory: Identify every ActiveMQ instance in your environment, especially those exposed to the internet or untrusted networks. Use asset management tools or network scans targeting /api/jolokia/.
  • Version Check: Verify the version of each instance. Any version earlier than 5.19.4 or between 6.0.0 and 6.2.3 is vulnerable.
  • Patch ASAP: Apply the vendor‑supplied patch by upgrading to 5.19.4 or 6.2.3 (or later). This removes the unsafe exec permissions from the Jolokia policy.
  • Mitigate if Patch Unavailable:
    • Disable the Jolokia bridge or restrict it to trusted IPs via firewall rules.
    • Harden the Jolokia policy to deny the exec operation on all MBeans.
    • Enforce strong authentication on the ActiveMQ web console; change default credentials.
  • Monitor: Look for suspicious HTTP requests to /api/jolokia/ that include the exec operation, and for outbound connections to unknown hosts from the broker host. Correlate with threat intel feeds; real‑time signals are available on the VulnSocial CVE page.
  • CISA Guidance: Follow the CISA KEV required actions – apply mitigations per vendor instructions, consider BOD 22‑01 guidance for cloud‑hosted services, or discontinue use if mitigations cannot be implemented before the 2026‑04‑30 deadline.

Remediation & Mitigation

  1. Upgrade: Upgrade all vulnerable ActiveMQ instances to version 5.19.4 or 6.2.3 (or newer). Verify the upgrade by checking the version string in the console.
  2. Disable Jolokia Exec: If immediate upgrade is not possible, edit the Jolokia access policy (typically jolokia-access.xml) to remove the exec operation for the org.apache.activemq:* MBean pattern.
  3. Network Segmentation: Place ActiveMQ brokers behind a firewall and restrict inbound traffic to trusted sources only. Block external access to /api/jolokia/.
  4. Authentication Hardening: Change default admin credentials, enforce strong passwords, and enable TLS for the web console.
  5. Continuous Monitoring: Deploy IDS/IPS rules to detect HTTP POSTs with the exec operation to the Jolokia endpoint. Use the VulnSocial CVE page for live exploitation indicators.
  6. Validate Configurations: Ensure that the brokerConfig parameter cannot be set to remote URLs. Review any custom Spring XML configurations for unsafe bean definitions.

Bottom Line

CVE-2026-34197 is a High severity RCE flaw in Apache ActiveMQ Classic that is already being actively exploited. Organizations must patch immediately (upgrade to 5.19.4 or 6.2.3) or apply strict mitigations to avoid a full compromise of their messaging infrastructure.

References