cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Apache ActiveMQ Classic flaw enables remote command execution

· Original article ↗

Summary

Researchers disclosed CVE-2026-34197, an ActiveMQ Classic RCE involving Jolokia and remote Spring XML loading. Apache fixed it in 5.19.4 and 6.2.3; CVE-2024-32114 leaves some affected versions exposed without authentication.

Key points

  • The flaw abuses Jolokia’s exposed addNetworkConnector function to make the broker load remote Spring XML and execute system commands during initialization.
  • The article reports affected versions before 5.19.4 and 6.0.0 through releases before 6.2.3.
  • Jolokia normally requires authentication, but CVE-2024-32114 exposes the API without access control in versions 6.0.0–6.1.1.
  • A Horizon3 researcher reported finding the issue with Claude AI by examining interactions among Jolokia, JMX, network connectors, and VM transports.
  • Apache fixed the issue in ActiveMQ Classic 5.19.4 and 6.2.3.
  • The flaw is not reported as actively exploited. Researchers recommend checking broker logs for suspicious VM transport connections and brokerConfig=xbean:http:// indicators.

Article Details

Vulnerability Types
  • Remote code execution (RCE)
Severity
High (CVSS 8.8)
Affected Versions
  • Apache ActiveMQ Classic versions before 5.19.4
  • Apache ActiveMQ Classic 6.0.0–6.2.3
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2016-3088Apache · Activemq“Both CVE-2016-3088, an authenticated RCE affecting the web console, and CVE-2023-46604, an unauthenticated RCE affecting the broker port, are on CISA’s KEV list.”CVE-2023-46604Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ Legacy OpenWire Module“Both CVE-2016-3088, an authenticated RCE affecting the web console, and CVE-2023-46604, an unauthenticated RCE affecting the broker port, are on CISA’s KEV list.”CVE-2024-32114apache · activemq; Apache Software Foundation · Apache ActiveMQAlthough Jolokia normally requires authentication, versions 6.0.0–6.1.1 are exposed unauthenticated due to CVE-2024-32114.CVE-2026-34197Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ All; +2 moreTracked as CVE-2026-34197 and found with the help of the Claude AI assistant, the flaw stems from Jolokia’s exposed addNetworkConnector enabling remote Spring XML loading.

People

Naveen SunkavallyHorizon3 researcher credited with discovering CVE-2026-34197 using Claude AI.

Vendors

ApacheSecurity researchers discovered a remote code execution vulnerability in Apache ActiveMQ Classic that went undetected for 13 years and can be exploited to run arbitrary system commands.

Products

Apache ActiveMQ ClassicSecurity researchers discovered a remote code execution vulnerability in Apache ActiveMQ Classic that went undetected for 13 years and can be exploited to run arbitrary system commands.

Tools

ClaudeTracked as CVE-2026-34197 and found with the help of the Claude AI assistant, the flaw stems from Jolokia’s exposed addNetworkConnector enabling remote Spring XML loading.

Industries

Governmentthe ‘Classic’ edition impacted by CVE-2026-34197 is widely deployed in enterprise, web backends, government, and company systems built on Java.

Related Articles