CISA Flags Apache ActiveMQ Flaw CVE-2026-34197 as Actively Exploited
Summary
CISA says attackers are actively exploiting CVE-2026-34197, an authenticated code-execution flaw in Apache ActiveMQ. Apache patched ActiveMQ Classic versions 6.2.3 and 5.19.4; federal agencies face an April 30 patching deadline.
Key points
- CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by April 30.
- The input-validation flaw allows authenticated attackers to execute arbitrary code.
- Apache patched the flaw in ActiveMQ Classic versions 6.2.3 and 5.19.4 on March 30.
- Horizon3 recommends checking broker logs for suspicious connections using the brokerConfig=xbean:http:// parameter and VM internal transport.
- ShadowServer was tracking more than 7,500 exposed ActiveMQ servers.
Article Details
- Vulnerability Types
- Improper input validation
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Discontinue use of ActiveMQ if mitigations are unavailable.
MITRE ATT&CK
CVE
CVE-2016-3088Apache · ActivemqPreviously, CISA tagged two other Apache ActiveMQ vulnerabilities as exploited in the wild, tracked as CVE-2023-46604 and CVE-2016-3088, with the former targeted by the TellYouThePass ransomware gang as a zero-day flaw.CVE-2023-46604Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ Legacy OpenWire ModulePreviously, CISA tagged two other Apache ActiveMQ vulnerabilities as exploited in the wild, tracked as CVE-2023-46604 and CVE-2016-3088, with the former targeted by the TellYouThePass ransomware gang as a zero-day flaw.CVE-2026-34197Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ All; +2 moreCISA warned that a high-severity Apache ActiveMQ vulnerability patched on March 30 (CVE-2026-34197) is being actively exploited, prompting an emergency federal patching deadline under BOD 22-01.