CVE-2026-34197

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 15.49%
EPSS Percentile: 96.74%
CISA KEV: YES — Known Exploited Vulnerability

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@apache.org
Published: 07-Apr-2026 16:16
Last Modified: 04-Aug-2026 20:18
EPSS Date: 2026-10-13
CWE: CWE-20, CWE-94, CWE-78

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-04-16
Remediation Due: 2026-04-30
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197

Affected Products / Versions

apache / activemq
Version / affected range: * · before (exclusive) 5.19.4
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
apache / activemq
Version / affected range: * · from (inclusive) 6.0.0 · before (exclusive) 6.2.3
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
apache / activemq_broker
Version / affected range: * · before (exclusive) 5.19.4
cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
apache / activemq_broker
Version / affected range: * · from (inclusive) 6.0.0 · before (exclusive) 6.2.3
cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*

References

Last enrichment sync: 14-Oct-2026 11:21
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

records in enterprise messaging software: CISA added an Apache ActiveMQ remote-code-execution flaw (CVE-2026-34197) to its Known Exploited Vulnerabilities catalog in April 2026 (BleepingComputer), and ransomware Censys Adds 22 Scanners to Map Internet-Exposed Services

CVE (1)

Threat Actors (1)

Vendors (4)

Products (7)

Industries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.