Loading vulnerability…
CVE-2026-42253 is an input neutralization flaw in Apache ActiveMQ and Apache ActiveMQ Web affecting the web console API MessageServlet. The servlet copies JMS message properties directly into HTTP response headers without validation or sanitization. Because attacker-controlled JMS message properties can be reflected into response headers, an attacker can overwrite or inject security-relevant headers in responses generated by the servlet. The issue is described as a cross-site scripting vulnerability and affects Apache ActiveMQ and Apache ActiveMQ Web before 5.19.7, and versions 6.0.0 through 6.2.5.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a research archive centered on Apache ActiveMQ Classic exploitation, not a single minimal PoC. It contains: (1) an original CVE-2026-34197 reproduction directory with Python exploit scripts, malicious Spring XML payloads, and a Docker lab; (2) a re-audit directory validating the RCE across multiple ActiveMQ versions with improved PoCs and bash automation; (3) a live re-audit for CVE-2026-42588 and CVE-2026-42253 with dedicated PoCs; and (4) a broader 6.2.6 source audit and findings ledger. Main exploit capability: the core exploit abuses the Jolokia JMX-over-HTTP endpoint on the ActiveMQ web console to invoke BrokerView.addNetworkConnector or addConnector with a crafted discovery URI. That URI embeds vm:// plus brokerConfig=xbean:<resource>, causing VMTransportFactory/XBeanBrokerFactory to load attacker-controlled Spring XML. The XML eagerly instantiates beans such as ProcessBuilder or Runtime.exec gadgets, yielding arbitrary command execution before broker validation. The repo demonstrates both the original remote-HTTP XML delivery (CVE-2026-34197) and the later patch-bypass logic (CVE-2026-42588), including no-paren/composite wrapper variants and a local-file xbean payload path. The exploit code is operational rather than framework-based. The Python scripts are self-contained and use only the standard library. They can host the malicious XML over an embedded HTTP server, probe Jolokia availability, discover broker names, send authenticated Jolokia exec requests with Basic auth and Origin headers, and wait for payload fetches as a success signal. The re-audit PoC in 02-reaudit-apr30/pocs/poc.py fixes earlier payload/server-timing issues and is the cleanest working implementation in the repo. A secondary exploit capability is included for CVE-2026-42253. The script 03-reaudit-42588-42253/lab/pocs/poc_42253.py targets /api/message/<queue> and demonstrates attacker-controlled JMS properties being reflected into HTTP response headers by MessageServlet, enabling arbitrary header injection, Content-Type override, cookie injection, and stored XSS. Fingerprintable targets and infrastructure are clear: the target service is ActiveMQ web console/Jolokia on port 8161, with OpenWire on 61616 in the lab. The exploit posts to /api/jolokia/, reads broker MBeans via /api/jolokia/read/..., and in the XSS PoC uses /api/message/<dest>. Attacker infrastructure is an HTTP server on ports 8888, 8889, or 9999 serving XML such as /poc-payload.xml, /evil.xml, or /poc.xml. Proof artifacts are written under /tmp on the target. Overall purpose: the repository documents exploit development, regression testing, and patch-bypass analysis for ActiveMQ Classic RCE, then extends into a broader security review of the fixed 6.2.6 release. It is a genuine exploit repository with working code, lab automation, and detailed writeups rather than a detection-only or fake project.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An HTTP response header injection vulnerability in Apache ActiveMQ and Apache ActiveMQ Web caused by improper handling of JMS message properties in MessageServlet, potentially enabling XSS, response manipulation, session hijacking, and clickjacking.
An Apache ActiveMQ input validation flaw in MessageServlet that allows header injection and can enable cross-site scripting by copying unsanitized message attributes into HTTP response headers.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.