CVE-2026-34197

KEVApache ActiveMQ Improper Input Validation Vulnerability

Description

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedApr 7, 2026

Last modifiedOct 26, 2026

Added to KEVApr 16, 2026

Remediation dueApr 30, 2026

References

activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txtVendor Advisory
openwall.com/lists/oss-security/2026/04/06/3Mailing ListThird Party Advisory
access.redhat.com/security/cve/CVE-2026-34197Third Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=2455869Third Party Advisory
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.jsonThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 181 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 98.3% · top 1% of all CVEs
Weakness: CWE-20
Attack vector: Network, remotely reachable

Recommended actions

1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.