Loading vulnerability…
Apache ActiveMQ is vulnerable to authenticated remote code execution through its Jolokia JMX-HTTP bridge. In affected configurations, Jetty exposes org.jolokia.http.AgentServlet at /api/jolokia. After authenticating to Jolokia, an attacker can submit crafted POST requests that are processed by org.jolokia.http.HttpRequestHandler#handlePostRequest, which builds JMX requests from attacker-controlled JSON and passes them to org.jolokia.http.HttpRequestHandler#executeRequest. Through the downstream request handling path, org.jolokia.handler.ExecHandler#doHandleRequest can be reached reflectively, allowing invocation of dangerous MBean operations. One documented exploitation path abuses unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl on Java 11 and later: the attacker invokes newRecording, then setConfiguration with payload data embedded in the configuration, then startRecording, and finally copyTo to write attacker-controlled content to a .jsp file on disk. This results in arbitrary code execution via deployment of a webshell.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a standalone Java Swing exploit toolkit for Apache ActiveMQ, not a Metasploit/Nuclei module. The project is Maven-based, with a single executable entry point in src/main/java/cc/kiiy/App.java that launches a GUI (MainFrame). The codebase is organized into service classes for exploitation/detection logic (EnvironmentService, VulnerabilityService), UI panels for each supported CVE and settings, and utility helpers for HTTP and local config handling. Core capability-wise, the tool supports both detection and exploitation. EnvironmentService fingerprints ActiveMQ by requesting the target URL and checking for the Apache ActiveMQ title, and can authenticate to /admin/ using HTTP Basic auth to extract hostname, version, and uptime from the admin console HTML. VulnerabilityService is the main exploit engine. For CVE-2015-5254, it accepts a user-provided Base64 serialized payload, decodes it, wraps it into an ActiveMQObjectMessage, and sends it over OpenWire/JMS to a chosen queue on tcp://<host>:<port> (default 61616), enabling broker-side deserialization when the message is processed/viewed. For CVE-2016-3088, it performs a PUT to /fileserver/<random>.txt and then a MOVE to file:///etc/cron.d/root, planting a cron entry that launches a Perl reverse shell back to the operator. This is a real exploitation path, not just a detector, but it depends on vulnerable behavior and elevated target privileges. The repository also includes support for CVE-2022-41678 workflows. Although the provided content truncates some of the implementation, the UI and service references clearly show functionality to write a default or custom webshell and then execute commands through it, with selectable methods such as auto, log4j2, and jfr. The included JfrTemplate.java contains a large embedded JFR configuration template, indicating one exploitation path abuses JFR-related file write/config behavior. BeanXmlPanel generates Spring BeanXML payloads using java.lang.ProcessBuilder for arbitrary command execution, likely intended to support XML-based ActiveMQ exploitation such as CVE-2023-46604-style xbean loading. The code also contains logic for a Jolokia-based probe labeled CVE-2026-34197 that sends an addNetworkConnector request with a vm://evil?brokerConfig=xbean:<xmlServer> argument, causing the target to fetch attacker-controlled XML from an external server. Network and fingerprintable artifacts are abundant: HTTP(S) access to the target web console and admin paths, OpenWire TCP access to port 61616, PUT/MOVE requests to /fileserver/, file destinations like file:///etc/cron.d/root, attacker XML hosting URLs, and Basic Authorization headers. The GUI exposes global custom headers and proxy settings, allowing the operator to tune requests and route traffic through a local proxy. Overall, this is an operational multi-CVE ActiveMQ exploitation toolkit with a GUI front end, combining reconnaissance, authenticated checks, payload generation, deserialization delivery, arbitrary file write abuse, XML-based RCE testing, and webshell management.
This repository provides a Python exploit (exp.py) for CVE-2022-41678, a remote code execution vulnerability in Apache ActiveMQ. The exploit targets the JMX (Jolokia) interface, which must be enabled and accessible on the target server. By abusing either the Log4j or Java Flight Recorder (JFR) MBeans, the script writes a malicious JSP webshell to the server's web directory (typically /admin/shell.jsp or /admin/shelljfr.jsp). The attacker can then execute arbitrary system commands by sending HTTP requests to the webshell endpoint with a 'cmd' parameter. The exploit requires valid credentials for the ActiveMQ console (default: admin/admin). The repository consists of a single exploit script (exp.py) and a README.md with detailed usage instructions. The exploit is operational, providing a working payload and automated exploitation process, but is not part of a larger framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior Apache ActiveMQ Classic vulnerability whose remediation introduced an overly broad Jolokia allow rule, indirectly contributing to the exposure of CVE-2026-34197.
A prior authenticated vulnerability involving Jolokia in which an attacker could invoke JDK MBeans such as FlightRecorder to write webshells to disk.
A prior authenticated vulnerability involving Apache ActiveMQ Jolokia access that allowed invocation of JDK MBeans such as FlightRecorder to write webshells to disk.
An authenticated remote code execution vulnerability in Apache ActiveMQ's Jolokia component.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.