Loading story…
Apache disclosed CVE-2026-34197, an important-severity remote code execution flaw in Apache ActiveMQ Broker and Apache ActiveMQ Classic that lets authenticated users execute code through the Jolokia JMX-HTTP bridge exposed at /api/jolokia/. The default Jolokia access policy permits exec operations on ActiveMQ MBeans, allowing attackers to call methods such as BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String) with a crafted discovery URI.
The exploit abuses the VM transport brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext, and Spring may instantiate singleton beans before ActiveMQ validates the configuration, enabling arbitrary code execution in the broker JVM, including through methods like Runtime.exec(). Apache said the issue affects versions before 5.19.4 in the 5.x line and 6.0.0 through before 6.2.3 in the 6.x line, and recommends upgrading to 5.19.5 or 6.2.3; the vulnerability was reported by Naveen Sunkavally of Horizon3.ai.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-41044, an important-severity authenticated remote code execution flaw in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All. The issue lets an authenticated attacker craft a malicious broker name through the admin console and abuse the DestinationView MBean exposed by Jolokia to load a remote Spring XML context; Apache said affected versions should be upgraded to 5.19.6 or 6.2.5.
Apache disclosed CVE-2026-40466, an important-severity vulnerability that can bypass the CVE-2026-34197 fix in Apache ActiveMQ when the activemq-http module is present. The flaw lets an authenticated attacker use HTTP Discovery transport to reach a malicious endpoint that returns a VM URI and ultimately load a remote Spring XML context for code execution; Apache advised upgrading to versions 5.19.6 or 6.2.5.
Shadowserver reported that more than 6,400 internet-exposed Apache ActiveMQ servers were still vulnerable to CVE-2026-34197 amid ongoing exploitation. It said the largest concentrations of exposed systems were in Asia, North America, and Europe, highlighting the scale of potential exposure.
After adding CVE-2026-34197 to the KEV catalog, CISA directed Federal Civilian Executive Branch agencies to remediate the Apache ActiveMQ vulnerability under Binding Operational Directive 22-01. The deadline for federal agencies to apply fixes or mitigations was set for 2026-04-30.
CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog and warned that the Apache ActiveMQ flaw is being actively exploited in the wild. The update elevated the issue from a disclosed and analyzed vulnerability to one with confirmed real-world exploitation.
Horizon3.ai released technical analysis of CVE-2026-34197, explaining exploitation via Jolokia's addNetworkConnector(String) to load a remote Spring XML file through vm:// and brokerConfig URLs. The post also noted that on ActiveMQ 6.0.0 through 6.1.1, chaining with CVE-2024-32114 can make the flaw effectively unauthenticated, and provided defender monitoring guidance for suspicious vm:// and brokerConfig=xbean:http activity.
Apache stated the issue affects versions before 5.19.4 in the 5.x line and versions from 6.0.0 before 6.2.3 in the 6.x line. It advised users to upgrade to versions 5.19.5 or 6.2.3 to remediate the vulnerability.
Apache disclosed an important-severity vulnerability, CVE-2026-34197, in Apache ActiveMQ Broker and Apache ActiveMQ Classic. The flaw allows authenticated users to achieve code execution via Jolokia JMX-HTTP operations such as BrokerService.addNetworkConnector(String) and addConnector(String).
Apache said CVE-2026-34197 was reported by Naveen Sunkavally of Horizon3.ai. The report concerned an authenticated remote code execution path through Jolokia-exposed ActiveMQ MBeans.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
23 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcescworld.com
Open sourcehorizon3.ai
Open sourcereddit.com
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceactivemq.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache ActiveMQ disclosed multiple related vulnerabilities in its Classic broker components that allow authenticated remote code execution through the Jolokia JMX-HTTP bridge exposed on the web console at `/api/jolokia/`. The flaws let an attacker invoke MBean methods such as `BrokerService.addNetworkConnector(String)` and `BrokerService.addConnector(String)` with crafted discovery URIs, abusing the VM transport `brokerConfig` parameter to load a remote Spring XML application context and execute arbitrary code in the broker JVM. Apache identified CVE-2026-42588 as the original issue and CVE-2026-45505 as a bypass of the earlier fix for CVE-2026-34197, caused by improper validation of non-parenthesized discovery wrappers including `masterslave:vm://...,...` and `static:vm://...`. The affected products are Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ versions before `5.19.7` and `6.0.0` through before `6.2.6`; Apache advises upgrading to `5.19.7` or `6.2.6` to remediate the exposure.
Jun 29, 2026
Apache ActiveMQ disclosed two related Jolokia security flaws that let authenticated low-privilege web users perform actions intended for administrators and, in more severe cases, execute arbitrary code on the broker JVM. The first issue, tracked as **`CVE-2026-49157`**, stems from incorrect default Jolokia authorization settings in the web console, allowing non-admin accounts to retain broker-management access and carry out operations such as adding or removing queues. A second flaw, **`CVE-2026-42588`**, allows remote code execution through the Jolokia JMX-HTTP bridge exposed at **`/api/jolokia/`** by invoking MBean `exec` operations such as `BrokerService.addNetworkConnector(String)`. A crafted `masterslave://` discovery URI can abuse the VM transport's `brokerConfig` parameter to load a Spring XML application context via `ResourceXmlApplicationContext`, enabling code execution before configuration validation completes. Both vulnerabilities affect Apache ActiveMQ versions before **`5.19.7`** and versions from **`6.0.0`** before **`6.2.6`**, and Apache has advised users to upgrade to those fixed releases.
Jun 29, 2026
Active exploitation has been observed against an Apache ActiveMQ remote code execution chain involving the Jolokia management API. VulnCheck reported canary-network hits tied to `CVE-2026-34197`, which was added to CISA's Known Exploited Vulnerabilities catalog, and said attackers are also using an unauthenticated variant that chains `CVE-2024-32114` with `CVE-2026-34197` to achieve zero-credential RCE. According to the reporting, `CVE-2024-32114` removes authentication from the Jolokia endpoint in ActiveMQ versions `6.0.0` through `6.1.1`, exposing the management interface to unauthenticated abuse. Technical details published by Horizon3.ai describe the RCE path through the Jolokia API, while VulnCheck said observed payloads invoked `addNetworkConnector` through Jolokia during exploitation. One captured payload referenced a private IP address, indicating the attacker activity may have reused a lab or proof-of-concept configuration, but the exploitation itself was confirmed in the wild. The combined reporting indicates that exposed ActiveMQ instances with vulnerable Jolokia configurations face immediate risk of unauthenticated remote compromise.
Jun 29, 2026