13-Year-Old RCE Vulnerability Found in Apache ActiveMQ Classic
Summary
Horizon3.ai reports that CVE-2026-34197 enables RCE in Apache ActiveMQ Classic through Jolokia and VM transport mechanisms. The flaw is fixed in versions 5.19.4 and 6.2.3; a separate flaw can expose Jolokia without authentication on some versions.
Key points
- CVE-2026-34197 allows attackers to invoke ActiveMQ management operations through the Jolokia API and trigger execution of OS commands.
- Exploitation involves ActiveMQ’s VM transport feature and a remotely retrieved Spring XML configuration file.
- Horizon3.ai says the flaw can bypass CVE-2022-41678, which allows webshell writes through specific JDK MBeans.
- On ActiveMQ versions 6.0.0 through 6.1.1, CVE-2024-32114 can leave the Jolokia API unauthenticated.
- The issue is fixed in Apache ActiveMQ Classic versions 5.19.4 and 6.2.3; users are advised to update.
Article Details
- Vulnerability Types
- Remote code execution
- Unauthenticated access
- Affected Versions
- Apache ActiveMQ 6.0.0–6.1.1
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe broker can be made to execute OS commands through the remote configuration and management-operation chain.T1210 · Exploitation of Remote ServicesThe vulnerability allows attackers to invoke ActiveMQ management operations through the Jolokia API and trigger remote code execution.T1505.003 · Web ShellThe article says CVE-2022-41678 allows attackers to write webshells to disk by invoking specific JDK MBeans.
CVE
CVE-2022-41678Apache Software Foundation · Apache ActiveMQAccording to Horizon3.ai, the security defect is a bypass for CVE-2022-41678, a bug that allows attackers to write webshells to disk by invoking specific JDK MBeans.CVE-2024-32114apache · activemq; Apache Software Foundation · Apache ActiveMQThe cybersecurity firm also notes that, on some deployments, RCE could be achieved without authentication by exploiting CVE-2024-32114, which exposes the Jolokia API to unauthenticated users.CVE-2026-34197Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ All; +2 moreTracked as CVE-2026-34197, the newly identified bug allows attackers to invoke management operations through the Jolokia API and entice the broker to retrieve a remote configuration file and execute OS commands.