{"id":"CVE-2026-34197","published":"2026-04-07T09:16:20Z","modified":"2026-10-26T22:10:00Z","title":"Apache ActiveMQ Improper Input Validation Vulnerability","vendor":"Apache","product":"ActiveMQ","tier":"core","eol":null,"description":{"text":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).\n\nAn authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.\n\n\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue","provenance":"source","from":"NVD"},"summary":{"text":"Apache ActiveMQ Classic's web console exposes a Jolokia JMX-HTTP bridge at /api/jolokia/, and its default access policy allows exec operations on ActiveMQ MBeans, including addNetworkConnector and addConnector, which can be abused through crafted discovery URIs that trigger the VM transport's brokerConfig parameter. An authenticated attacker with network access can exploit this to load a remote Spring XML application context, achieving arbitrary code execution on the broker's JVM without user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:32:16Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98256,"percentile":0.99916,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-04-16","dueDate":"2026-04-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-04-13","exploitedFirstSeen":"2026-04-13","ransomware":false,"evidence":[{"url":"https://www.fortiguard.com/encyclopedia/ips/60672","date":"2026-04-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-04-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-04-24&host_type=src&vulnerability=cve-2026-34197","date":"2026-04-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-01&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-02&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-13&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-15&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-16&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-17&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-18&host_type=src&vulnerability=cve-2026-34197","date":"2026-05-18"}],"evidenceTotal":104,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-94","name":"Improper Control of Generation of Code"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/06/3","tags":["Mailing List","Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34197","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455869","tags":["Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploit via exposed web management Jolokia interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An authenticated attacker can invoke these operations with a crafted discovery URI","start":440,"end":522}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution on broker JVM","mappingType":"primary_impact","evidence":[{"from":"description","quote":"arbitrary code execution occurs on the broker's JVM through bean factory methods","start":798,"end":878}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-broker","vulnerableRanges":["<5.19.5",">=6.0.0, <6.2.3"],"patched":["5.19.5","6.2.3"],"from":["GHSA-rxpj-7qvf-xv32"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-all","vulnerableRanges":["<5.19.5",">=6.0.0, <6.2.3"],"patched":["5.19.5","6.2.3"],"from":["GHSA-rxpj-7qvf-xv32"],"provenance":"source"}],"advisories":[{"id":"GHSA-rxpj-7qvf-xv32","url":"https://github.com/advisories/GHSA-rxpj-7qvf-xv32","severity":"HIGH","ecosystem":"Maven","package":"org.apache.activemq:activemq-broker","vulnerableRanges":["<5.19.5"],"patched":["5.19.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rxpj-7qvf-xv32","url":"https://github.com/advisories/GHSA-rxpj-7qvf-xv32","severity":"HIGH","ecosystem":"Maven","package":"org.apache.activemq:activemq-broker","vulnerableRanges":[">=6.0.0, <6.2.3"],"patched":["6.2.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rxpj-7qvf-xv32","url":"https://github.com/advisories/GHSA-rxpj-7qvf-xv32","severity":"HIGH","ecosystem":"Maven","package":"org.apache.activemq:activemq-all","vulnerableRanges":["<5.19.5"],"patched":["5.19.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rxpj-7qvf-xv32","url":"https://github.com/advisories/GHSA-rxpj-7qvf-xv32","severity":"HIGH","ecosystem":"Maven","package":"org.apache.activemq:activemq-all","vulnerableRanges":[">=6.0.0, <6.2.3"],"patched":["6.2.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-19588","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19588","exploited":true,"exploitedSince":"2026-04-16","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":3,"earliest":"2026-04-08","earliestUrl":"https://github.com/0xBlackash/CVE-2026-34197","repos":[{"name":"Catherines77/ActiveMQ-EXPtools","url":"https://github.com/Catherines77/ActiveMQ-EXPtools","stars":86,"created":"2026-04-20"},{"name":"dinosn/apache-activemq-rce-research","url":"https://github.com/dinosn/apache-activemq-rce-research","stars":9,"created":"2026-07-04"},{"name":"dinosn/CVE-2026-34197","url":"https://github.com/dinosn/CVE-2026-34197","stars":8,"created":"2026-04-08"},{"name":"DEVSECURITYSPRO/CVE-2026-34197","url":"https://github.com/DEVSECURITYSPRO/CVE-2026-34197","stars":4,"created":"2026-04-08"},{"name":"AtoposX-J/CVE-2026-34197-Apache-ActiveMQ-RCE","url":"https://github.com/AtoposX-J/CVE-2026-34197-Apache-ActiveMQ-RCE","stars":2,"created":"2026-04-09"}]},"metasploit":[{"name":"Apache ActiveMQ RCE via Jolokia addNetworkConnector","module":"exploit/multi/http/apache_activemq_jolokia_rce","type":"exploit","disclosureDate":"2026-04-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_activemq_jolokia_rce.rb"}],"nuclei":[{"id":"CVE-2026-34197","name":"Apache ActiveMQ - Remote Code Execution","severity":"critical","path":"http/cves/2026/CVE-2026-34197.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34197.yaml"}],"first":{"date":"2026-04-08","source":"PoC-in-GitHub","url":"https://github.com/0xBlackash/CVE-2026-34197"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-04-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34197","provenance":"source"},{"date":"2026-04-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-04-29","url":"https://github.com/0xBlackash/CVE-2026-34197","provenance":"source"},{"date":"2026-04-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/encyclopedia/ips/60672","provenance":"source"},{"date":"2026-04-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19588","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":9},"priority":{"score":74.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 201 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-activemq-broker-cve-2026-34197","children":[{"from":"CVE-2026-34197","to":"CVE-2026-40466","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the cla…","from":"CVE.org","in":"CVE-2026-40466"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"5.19.5","toFixed":"5.19.6","daysApart":17},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-all","fromFixed":"5.19.5","toFixed":"5.19.6","daysApart":17},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same package + description similarity"}]},{"from":"CVE-2026-34197","to":"CVE-2026-45505","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.","from":"CVE.org","in":"CVE-2026-45505"},{"kind":"osv-related","provenance":"source","id":"GHSA-v853-w46p-fv2h","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34197"},{"kind":"similar","provenance":"machine","score":0.85,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2014-3612","published":"2015-08-24","fixed":"5.10.1","kev":false},{"cve":"CVE-2015-6524","published":"2015-08-24","fixed":"5.10.2","kev":false},{"cve":"CVE-2026-33227","published":"2026-04-07","fixed":"6.2.2","kev":false,"link":{"from":"CVE-2026-33227","to":"CVE-2026-34197","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"6.2.2","toFixed":"6.2.3","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-all","fromFixed":"6.2.2","toFixed":"6.2.3","daysApart":0}]}},{"cve":"CVE-2026-34197","published":"2026-04-07","fixed":"6.2.3","kev":true},{"cve":"CVE-2026-39304","published":"2026-04-10","fixed":"6.2.4","kev":false,"link":{"from":"CVE-2026-39304","to":"CVE-2026-34197","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"5.19.4","toFixed":"5.19.5","daysApart":-3},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"6.2.3","toFixed":"6.2.4","daysApart":3}]}},{"cve":"CVE-2026-40466","published":"2026-04-24","fixed":"6.2.5","kev":false},{"cve":"CVE-2026-41043","published":"2026-04-24","fixed":"6.2.5","kev":false,"link":{"from":"CVE-2026-34197","to":"CVE-2026-41043","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"5.19.5","toFixed":"5.19.6","daysApart":17},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-all","fromFixed":"5.19.5","toFixed":"5.19.6","daysApart":17}]}},{"cve":"CVE-2026-41044","published":"2026-04-24","fixed":"6.2.5","kev":false,"link":{"from":"CVE-2026-34197","to":"CVE-2026-41044","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"5.19.5","toFixed":"5.19.6","daysApart":17},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-all","fromFixed":"5.19.5","toFixed":"5.19.6","daysApart":17},{"kind":"similar","provenance":"machine","score":0.56,"basis":"same product + CWE + description similarity"}]}}],"package":"Maven:org.apache.activemq:activemq-broker"}}