CVE-2022-41678: Apache ActiveMQ Jolokia authenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high EPSS (0.8581) make this a serious RCE risk, though it requires authenticated Jolokia access and is not in KEV.

What it is

An authenticated Jolokia user on Apache ActiveMQ can invoke JMX MBeans through the AgentServlet's POST handler, reaching ExecHandler#doHandleRequest via reflection. This enables arbitrary code execution, for example by abusing unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl on Java 11 and above to write a JSP webshell. The flaw is an authorization weakness in Jolokia's default configuration rather than a memory-safety bug.

Impact

An attacker with valid Jolokia credentials gains remote code execution on the ActiveMQ host, allowing webshell deployment and full compromise of the broker and its data.

Attack surface

Reachable over the network through the Jolokia HTTP endpoint exposed by ActiveMQ's Jetty configuration, specifically POST requests to /api/jolokia. Authentication is required (PR:L) but no user interaction is needed, and the attack is network-accessible with low complexity.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is very high at 0.8581 (99.7th percentile), indicating strong likelihood of exploitation activity. Vendor advisories confirm the issue and the fix.

What to do

• Upgrade to ActiveMQ 5.16.6, 5.17.4, 5.18.0, or 6.0.0, which ship a more restrictive Jolokia configuration.
• If upgrade is not possible, restrict the actions Jolokia authorizes by default or disable the Jolokia agent entirely.
• Restrict network access to the Jolokia endpoint so only trusted management hosts can reach it.
• Rotate credentials for any account with Jolokia access and audit for unauthorized MBean invocations.
• Run ActiveMQ on a Java version where the FlightRecorderMXBean deserialization path is not exposed, or block that MBean from Jolokia exec.

Detection

• Monitor Jolokia POST requests to /api/jolokia for exec operations against MBeans such as FlightRecorderMXBeanImpl.
• Alert on creation of new .jsp files in ActiveMQ web directories or other unexpected file writes.
• Review ActiveMQ and Jolokia logs for anomalous JMX exec calls, especially newRecording, setConfiguration, startRecording, and copyTo sequences.
• Baseline and monitor outbound connections from the ActiveMQ host for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.