CVE-2026-34197
Apache ActiveMQ Improper Input Validation Vulnerability
Description
CVE-2026-34197 is a HIGH-severity code injection vulnerability in Apache ActiveMQ with a CVSS 3.1 score of 8.8. The flaw affects the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the ActiveMQ web console, where the default access policy permits exec operations on all ActiveMQ MBeans, allowing an authenticated attacker to invoke BrokerService.addNetworkConnector or BrokerService.addConnector with a crafted discovery URI that loads a remote Spring XML application context and executes arbitrary code on the broker's JVM. CISA has added CVE-2026-34197 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-04-30, and with an EPSS score of 46.6% (97.67th percentile) this Apache ActiveMQ vulnerability is among the most likely to be exploited in the wild. Organizations running Apache ActiveMQ Broker, Apache ActiveMQ All, or Apache ActiveMQ before version 5.19.4 or between 6.0.0 and 6.2.3 should treat this as a critical security issue requiring immediate action.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | activemq | < 5.19.4; >= 6.0.0, < 6.2.3 |
| apache | activemq broker | < 5.19.4; >= 6.0.0, < 6.2.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt(Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2026/04/06/3(Mailing List, Third Party Advisory)
- https://access.redhat.com/security/cve/CVE-2026-34197(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2455869(Third Party Advisory)
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2026-34197 stems in part from improper input validation, where Apache ActiveMQ accepts a user-supplied discovery URI passed through the Jolokia JMX-HTTP bridge without verifying that it meets the properties required for safe processing. The Jolokia endpoint passes the attacker-controlled URI directly to the VM transport's brokerConfig parameter, which then references remote resources, turning a seemingly benign configuration input into a code execution primitive.
Learn more: CWE-20 — Improper Input Validation
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2026-34197 is also a textbook code injection vulnerability: attacker-controlled input is used to construct a code segment that is subsequently interpreted by the application runtime. In this case, Spring's ResourceXmlApplicationContext parses the remote XML application context and instantiates all singleton beans before the BrokerService validates the configuration, which means arbitrary code execution occurs through bean factory methods such as Runtime.exec() on the broker's JVM.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2026-34197 carries a CVSS 3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the Apache ActiveMQ broker is remotely exploitable over the network without physical access, the attack is easy to execute with no special conditions, and no user interaction is required. Privileges Required (Low) means the attacker must be authenticated to the web console, which is a meaningful but often weak barrier given the prevalence of default or shared credentials in broker deployments. Confidentiality, Integrity, and Availability impacts are all rated HIGH, so a successful exploit grants the attacker the ability to read sensitive message data flowing through the broker, modify routing and broker configuration, and fully disrupt messaging services that business-critical applications depend on. Although the Scope is Unchanged, compromise of an ActiveMQ broker typically yields a pivot point into the surrounding application environment, and with an EPSS score of 46.6% placing this vulnerability in the 97.67th percentile, the likelihood of exploitation is substantially above the baseline for KEV-listed issues.
Exploit Maturity
Active exploitation of CVE-2026-34197 has been confirmed by CISA, which added this Apache ActiveMQ vulnerability to the Known Exploited Vulnerabilities catalog on 2026-04-16 with a federal remediation deadline of 2026-04-30. Exploitation probability is exceptionally high: the EPSS score of 46.6% places CVE-2026-34197 in the 97.67th percentile, indicating near-certain ongoing exploitation activity in the wild. Public discussion of the technique appeared on the oss-security mailing list and in the Apache security advisory, providing attackers with the architectural details needed to build working exploits, and Jolokia plus Spring ResourceXmlApplicationContext chains have a long track record of being weaponized. Ransomware association has not been confirmed by KEV at this time, but given prior ActiveMQ vulnerabilities have been used by ransomware operators, defenders should assume the same threat actors are evaluating this issue and act immediately.
Remediation
- Apply the Apache ActiveMQ security update immediately. CISA's KEV directive requires remediation by 2026-04-30. Upgrade Apache ActiveMQ Broker and Apache ActiveMQ All to version 5.19.4 (for the 5.x branch) or 6.2.3 (for the 6.x branch), as per the vendor advisory at activemq.apache.org.
- Inventory every ActiveMQ instance in your environment. Scan for all Apache ActiveMQ deployments, including shadow IT and embedded brokers inside commercial products. Affected versions are < 5.19.4 and >= 6.0.0, < 6.2.3 across Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All.
- Disable or restrict the Jolokia endpoint where patching is delayed. Remove or reconfigure the Jolokia access policy (jolokia-access.xml) to deny exec operations on org.apache.activemq:* MBeans, restrict access to BrokerService.addNetworkConnector and BrokerService.addConnector, and block access to /api/jolokia/ at the reverse proxy or WAF layer until upgrades are complete.
- Harden broker authentication and network exposure. Ensure the ActiveMQ web console is not reachable from untrusted networks, enforce strong authentication for all broker accounts, and rotate any credentials that may have been exposed. This reduces the impact of the Privileges Required (Low) CVSS metric.
- Hunt for indicators of exploitation. Review broker logs for unexpected calls to addNetworkConnector or addConnector, outbound HTTP(S) fetches from the broker JVM to unknown hosts, spawned child processes under the ActiveMQ service account, and anomalous Jolokia POST requests. Any of these signals warrant treating the host as potentially compromised.
- Address the underlying code injection risk. Following CWE-20 and CWE-94 guidance, implement strict allowlist validation for any configuration parameters that reference remote resources, and restrict the broker JVM's ability to reach outbound destinations via egress filtering to prevent remote Spring XML loads.
Technical Details
CVE-2026-34197 originates in how Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console, where the default Jolokia access policy permits exec operations on all ActiveMQ MBeans under the org.apache.activemq:* namespace, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). Exploitation mechanism: an authenticated attacker invokes these MBean operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext; because Spring instantiates all singleton beans defined in that XML before the BrokerService validates the configuration, arbitrary Java code runs on the broker's JVM through bean factory methods such as Runtime.exec(). Underlying weakness: the vulnerability combines CWE-20 (Improper Input Validation) — the discovery URI is not constrained to safe values — with CWE-94 (Code Injection) — externally-influenced input drives the generation and execution of code via Spring bean construction. CVSS vector analysis: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects remote network exploitability, low complexity, low authenticated privileges, no user interaction, unchanged scope, and full loss of confidentiality, integrity, and availability on the compromised broker.
Frequently Asked Questions
Is CVE-2026-34197 being actively exploited?
Yes. CISA added CVE-2026-34197 to the Known Exploited Vulnerabilities catalog on 2026-04-16, confirming active exploitation of Apache ActiveMQ in the wild. The EPSS score of 46.6% (97.67th percentile) places this vulnerability among the most likely in the entire CVE corpus to see continued exploitation.
What products are affected by CVE-2026-34197?
CVE-2026-34197 affects Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ in all versions before 5.19.4 and in the 6.x branch from 6.0.0 up to (but not including) 6.2.3. Both on-premises deployments and embedded ActiveMQ brokers shipped inside third-party products should be inventoried and patched.
How do I fix CVE-2026-34197?
Upgrade Apache ActiveMQ to version 5.19.4 or 6.2.3 per the Apache security advisory. Where immediate patching is not possible, restrict the Jolokia access policy to deny exec operations on ActiveMQ MBeans, block /api/jolokia/ at the reverse proxy, and tightly limit network access to the web console. Hunt broker logs for unexpected addNetworkConnector or addConnector invocations to detect prior exploitation.
How severe is CVE-2026-34197?
CVE-2026-34197 is rated HIGH with a CVSS 3.1 score of 8.8 and leads to arbitrary code execution on the broker's JVM with full impact on confidentiality, integrity, and availability. Its EPSS score of 46.6% sits in the 97.67th percentile, and CISA requires federal agencies to remediate by 2026-04-30, which all organizations should treat as a firm deadline for their own remediation plans.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.