Apache ActiveMQ Improper Input Validation Vulnerability
Apache · ActiveMQ
Apache ActiveMQ Classic's web console exposes a Jolokia JMX-HTTP bridge at /api/jolokia/, and its default access policy allows exec operations on ActiveMQ MBeans, including addNetworkConnector and addConnector, which can be abused through crafted discovery URIs that trigger the VM transport's brokerConfig parameter. An authenticated attacker with network access can exploit this to load a remote Spring XML application context, achieving arbitrary code execution on the broker's JVM without user interaction.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 6 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+1 day
- First seen exploitedVulnCheck KEV evidence+6 days
- Added to CISA KEVEU database agrees+9 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family treeA fix was bypassed or incomplete 2 times over 8 weeks. The latest fix listed for activemq-broker is 6.2.5.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- This CVECVE-2026-34197ActiveMQ Improper Input Validation7 Apr 2026KEV
bypassed the fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the cla…
- Fixed one release later5.19.5 → 5.19.6 (org.apache.activemq:activemq-broker)
- Fixed one release later5.19.5 → 5.19.6 (org.apache.activemq:activemq-all)
- Similar weakness in the same product (machine-matched)same package + description similarity
- Stated in the CVE text
- same family
- same family
- same family
Fixes in activemq-brokerMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 5.10.1CVE-2014-361224 Aug 2015
- 5.10.2CVE-2015-652424 Aug 2015
- 6.2.2CVE-2026-332277 Apr 2026
- 6.2.3CVE-2026-341977 Apr 2026KEV
- 6.2.4CVE-2026-3930410 Apr 2026
- 6.2.5CVE-2026-4046624 Apr 2026
- 6.2.5CVE-2026-4104324 Apr 2026
- 6.2.5CVE-2026-4104424 Apr 2026Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passages 2Initial AccessTA0001
Remote exploit via exposed web management Jolokia interface
An authenticated attacker can invoke these operations with a crafted discovery URI
ExecutionTA0002
Arbitrary code execution on broker JVM
arbitrary code execution occurs on the broker's JVM through bean factory methods
Detection
0 rules for this CVE · 244 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2026-34197 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.apache.activemq:activemq-brokerAffected: 6.0.0 up to 6.2.3; All versions before 5.19.5Upgrade to 6.2.5 or later (older lines: 5.19.6)
- Mavenorg.apache.activemq:activemq-allAffected: 6.0.0 up to 6.2.3; All versions before 5.19.5Upgrade to 6.2.5 or later (older lines: 5.19.6)
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 31, 202630 Oct 2026
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- 44 more on OTX