Actively Exploited Apache ActiveMQ Flaw Affects 6,400 Exposed Servers
Summary
Shadowserver found over 6,400 exposed Apache ActiveMQ servers vulnerable to CVE-2026-34197, an actively exploited authenticated code-execution flaw. Apache patched ActiveMQ Classic 6.2.3 and 5.19.4; CISA set an April 30 deadline for federal agencies.
Key points
- Shadowserver reported more than 6,400 internet-exposed ActiveMQ instances vulnerable to CVE-2026-34197.
- The flaw stems from improper input validation and can allow authenticated attackers to execute arbitrary code on unpatched systems.
- Apache patched the vulnerability in ActiveMQ Classic versions 6.2.3 and 5.19.4 on March 30.
- CISA warned that the flaw is being actively exploited and directed federal civilian agencies to secure affected servers by April 30.
- Horizon3 advised administrators to check broker logs for suspicious VM transport connections and the brokerConfig=xbean:http:// parameter.
- Shadowserver's counts placed most vulnerable exposed instances in Asia, North America, and Europe.
Article Details
- Vulnerability Types
- Improper input validation
- Code injection
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply mitigations per vendor instructions.
- For cloud services, follow applicable BOD 22-01 guidance.
- Discontinue use of the product if mitigations are unavailable.
MITRE ATT&CK
CVE
CVE-2016-3088Apache · ActivemqbrokerConfig=xbean:http:// indicators, noting ActiveMQ has been repeatedly targeted, including past CVE-2016-3088 and CVE-2023-46604 incidents.CVE-2023-46604Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ Legacy OpenWire Moduleindicators, noting ActiveMQ has been repeatedly targeted, including past CVE-2016-3088 and CVE-2023-46604 incidents.CVE-2026-34197Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ All; +2 moreShadowserver found more than 6,400 Apache ActiveMQ servers exposed online that are vulnerable to ongoing attacks exploiting a high-severity code-injection flaw tracked as CVE-2026-34197.
People
Threat Actors
Vendors
Products
ActiveMQ Classicinput validation bug allows authenticated attackers to execute arbitrary code and was patched in ActiveMQ Classic 6.2.3 and 5.19.4 on March 30;Apache ActiveMQShadowserver found more than 6,400 Apache ActiveMQ servers exposed online that are vulnerable to ongoing attacks exploiting a high-severity code-injection flaw tracked as CVE-2026-34197.