CVE-2026-34197

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on its web console, and the default Jolokia access policy allows authenticated users to invoke exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker abuses these operations with a crafted discovery URI so that the VM transport's brokerConfig parameter loads a remote Spring XML application context; because ResourceXmlApplicationContext instantiates singleton beans before the BrokerService validates the configuration, arbitrary code runs in the broker's JVM (e.g., through Runtime.exec() bean factory methods), yielding code execution with the broker's privileges. Affected users are those running Apache ActiveMQ Broker, ActiveMQ All, or ActiveMQ (Classic) on versions before 5.19.4 or 6.x versions from 6.0.0 before 6.2.3. Authentication to the web console is required (CVSS privileges-required: low), but CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-16 amid reported active exploitation, and EPSS puts 30-day exploitation probability at 98.3%. No public proof-of-concept is known, and whether ransomware groups are using it is unknown.

What to do: Upgrade Apache ActiveMQ to 5.19.4 (5.x line) or 6.2.3 (6.x line), which fix the issue; federal agencies must apply mitigations under BOD 22-01 timelines. As interim mitigation, restrict access to the web console /api/jolokia/ endpoint, tighten the Jolokia access policy so exec is not permitted on org.apache.activemq:* MBeans (especially BrokerService.addNetworkConnector/addConnector), and enforce strong authentication. Review broker logs for Jolokia calls to these operations and for unexpected VM-transport connector additions.