Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-32114 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default. NVD description · AI analysis pending | 8.8 | 7% |
| — | ||
| CVE-2026-34197 | Authenticated RCE in Apache ActiveMQ via Jolokia JMX-HTTP Bridge Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on its web console, and the default Jolokia access policy allows authenticated users to invoke exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker abuses these operations with a crafted discovery URI so that the VM transport's brokerConfig parameter loads a remote Spring XML application context; because ResourceXmlApplicationContext instantiates singleton beans before the BrokerService validates the configuration, arbitrary code runs in the broker's JVM (e.g., through Runtime.exec() bean factory methods), yielding code execution with the broker's privileges. Affected users are those running Apache ActiveMQ Broker, ActiveMQ All, or ActiveMQ (Classic) on versions before 5.19.4 or 6.x versions from 6.0.0 before 6.2.3. Authentication to the web console is required (CVSS privileges-required: low), but CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-16 amid reported active exploitation, and EPSS puts 30-day exploitation probability at 98.3%. No public proof-of-concept is known, and whether ransomware groups are using it is unknown. Do: Upgrade Apache ActiveMQ to 5.19.4 (5.x line) or 6.2.3 (6.x line), which fix the issue; federal agencies must apply mitigations under BOD 22-01 timelines. As interim mitigation, restrict access to the web console /api/jolokia/ endpoint, tighten the Jolokia access policy so exec is not permitted on org.apache.activemq:* MBeans (especially BrokerService.addNetworkConnector/addConnector), and enforce strong authentication. Review broker logs for Jolokia calls to these operations and for unexpected VM-transport connector additions. | 8.8 | 98% | KEV |
| large≈10,000–100,000 exposed systems, plausibly 100,000+ installations overall (public scans typically show tens of thousands of ActiveMQ web consoles;… |
Full article397 words · extracted from helpnetsecurity.com · click to collapse
In the latest demonstration of how AI assistants can help with bug hunting, Horizon3.ai researcher Naveen Sunkavally used Claude to unearth CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ that’s been introduced in the codebase 13 years ago.
The vulnerability was patched in late March 2026 and there’s currently no indication that it is being actively exploited by attackers.
Neveretheless, with ActiveMQ vulnerabilities having been previously leveraged for ransomware and malware attacks, organizations should update their installations and look for potential indicators of compromise.
About CVE-2026-34197
CVE-2026-34197 is a improper input validation and code injection vulnerability in the popular Apache ActiveMQ open-source message broker for asynchronous communication.
“ActiveMQ comes in two flavors: ActiveMQ Classic, the original broker, and ActiveMQ Artemis, a newer implementation. This vulnerability affects Classic only,” Sunkavally noted.
“In hindsight, the vulnerability is obvious, but you can see why it was missed over the years. It involved multiple components developed independently over time: Jolokia, JMX, network connectors, and VM transports. Each feature in isolation does what it’s supposed to, but they were dangerous together. This is exactly where Claude shone – efficiently stitching together this path end to end with a clear head free of assumptions.”
Sunkavally also noted that while the vulnerability normally requires credentials, default username and password combinations (e.g., admin:admin) are widely used across many environments.
“On some versions (6.0.0–6.1.1), no credentials are required at all due to another vulnerability, CVE-2024-32114, which inadvertently exposes the Jolokia API without authentication. In those versions, CVE-2026-34197 is effectively an unauthenticated RCE,” he explained.
Mitigation and investigation
CVE-2026-34197 has been fixed in ActiveMQ versions 6.2.3 and 5.19.4, and organizations using ActiveMQ should upgrade to one of them as soon as possible, especially now that technical details are public.
Sunkavally also advised organizations to check their ActiveMQ broker logs for possible inficators of compromise:
- Network connector activity referencing vm:// URIs with brokerConfig=xbean:http.
- POST requests to /api/jolokia/ containing addNetworkConnector in the request body
- Outbound HTTP requests from the ActiveMQ broker process to unexpected hosts, and
- Unexpected child processes spawned by the ActiveMQ Java process
UPDATE (April 21, 2026, 06:05 a.m. ET):
CISA has added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog.
Shadowserver “sees” nearly 6,500 vulnerable Apache ActiveMQ deployments reachable from the internet.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/04/09/apache-activemq-rce-vulnerability-cve-2026-34197-claude/