CVE-2024-32114

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 7.15%
EPSS Percentile: 94.29%
CISA KEV: Not listed

Description

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 02-May-2024 16:15
Last Modified: 17-Jun-2026 14:29
EPSS Date: 2026-11-04
CWE: CWE-1188

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

apache · activemq Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

6.x — affected

CPEs: cpe:2.3:a:apache:activemq:-:*:*:*:*:*:*:*
Apache Software Foundation · Apache ActiveMQ Source: CNA · [email protected]
Default status: unaffected

6.0.0 ≤ version ≤ 6.1.1 — affected (semver)

Affected Products / Versions

apache / activemq Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.0.0 · before (exclusive) 6.1.2
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

References

af854a3a-2127-422b-91ae-364da2661108

Last enrichment sync: 05-Nov-2026 10:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

VulnCheck said it’s seeing active exploitation of the Apache ActiveMQ Jolokia remote code execution chain that strings together CVE-2026-34197 and CVE-2024-32114. Weekly Security Roundup: KelpDAO Exploit, Malicious npm Packages, Active RCEs and More
A remote code execution (RCE) vulnerability that lurked in Apache ActiveMQ Classic for 13 years could be chained with an older flaw (CVE-2024-32114) to bypass authentication. Weekly Security Roundup Details Phorpiex Botnet, ActiveMQ RCE and AI-Related Threats
Although Jolokia normally requires authentication, versions 6.0.0–6.1.1 are exposed unauthenticated due to CVE-2024-32114. Apache ActiveMQ Classic flaw enables remote command execution
The cybersecurity firm also notes that, on some deployments, RCE could be achieved without authentication by exploiting CVE-2024-32114, which exposes the Jolokia API to unauthenticated users. 13-Year-Old RCE Vulnerability Found in Apache ActiveMQ Classic

CVE (10)

Malware (18)

People (6)

Threat Actors (9)

MITRE ATT&CK (14)

Vendors (13)

Products (20)

Tools (5)

Industries (10)

Countries (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.