Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
CISA KEV · ACTIVELY EXPLOITED
HIGH severity

CVE-2026-34197 — activemq-broker

HIGH

CVE-2026-34197 is a high-severity (CVSS 8.8) Improper Input Validation vulnerability in org.apache.activemq:activemq-broker. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-04-16) — treat it as actively exploited and patch now. A fix is available for org.apache.activemq:activemq-broker — see the affected versions and patch details below.

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Also known asBIT-activemq-2026-34197GHSA-rxpj-7qvf-xv32
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
5 known
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-04-16. Federal agencies were required to remediate by 2026-04-30.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2026-34197.

EPSS Exploitation Probability

via FIRST.org ↗
15.5%probability of exploitation in next 30 days
Moderate Risk0.00%
Lower risk than most CVEs97th percentile — riskier than 97% of all scored CVEsHighest risk
0.00%33.3%66.7%100.0%96.7%15.5%15.5%Jul 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-34197 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

4 pkgs affected
☕org.apache.activemq:activemq-broker☕org.apache.activemq:activemq-broker☕org.apache.activemq:activemq-all☕org.apache.activemq:activemq-all

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.activemq:activemq-brokerall versions5.19.5org.apache.activemq:activemq-broker:5.19.5
☕Mavenorg.apache.activemq:activemq-broker≥ 6.0.0&&< 6.2.36.2.3org.apache.activemq:activemq-broker:6.2.3
☕Mavenorg.apache.activemq:activemq-allall versions5.19.5org.apache.activemq:activemq-all:5.19.5
☕Mavenorg.apache.activemq:activemq-all≥ 6.0.0&&< 6.2.36.2.3org.apache.activemq:activemq-all:6.2.3

Affected Products

2 products · 4 configurations
Application
activemqapache
≥ 6.0.0 && < 6.2.3
range
Application
activemq brokerapache
≥ 6.0.0 && < 6.2.3
range
Exploits & PoCs
5

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Catherines77/ActiveMQ-EXPtools

Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2

⭐ 83🍴 9Sep 2026

dinosn/apache-activemq-rce-research

Apache ActiveMQ Classic RCE research: CVE-2026-34197 / CVE-2026-42588 by

⭐ 9🍴 4Aug 2026

dinosn/CVE-2026-34197

CVE-2026-34197 activemq PoC

⭐ 8🍴 0Jul 2026

DEVSECURITYSPRO/CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ RCE via Jolokia Endpoint PoC

⭐ 4🍴 0May 2026

K3ysTr0K3R/CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia Remote Code Execution (RCE)

⭐ 3🍴 0Sep 2026

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.activemq:activemq-broker, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.activemq:activemq-broker to 5.19.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-34197 is resolved across your whole dependency graph.

  3. Workarounds

    Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

How to detect CVE-2026-34197

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2026-34197 -u https://target
Template
Apache ActiveMQ - Remote Code Execution
Severity
critical
Impact
Authenticated attackers can execute arbitrary code on the broker JVM, potentially leading to full system compromise.
Remediation
Upgrade to version 5.19.5 or 6.2.3 or later.

Template by ProjectDiscovery nuclei-templates (DhiyaneshDk, horizon3), MIT licensed. View the full template. Scan only systems you are authorised to test.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is an Important severity flaw as it could enable a remote, authenticated attacker to execute arbitrary code on the broker's JVM. This can be exploited by sending a specially crafted discovery URI to the Jolokia JMX-HTTP bridge, which is exposed on the web console. This bypasses configuration validation and allows…

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for CVE-2026-34197 (CC BY 4.0)

Frequently Asked Questions

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spri
O3 Security · Impact-Aware SCA

Is CVE-2026-34197 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-34197: activemq-broker RCE (High 8.8, KEV)