CVE-2026-34197: Apache ActiveMQ Jolokia JMX bridge code injection via broker config URI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw yields authenticated remote code execution on the broker, is listed in CISA KEV with a near-certain EPSS score, and has a published vendor fix.

What it is

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ with a default policy that allows exec operations on all org.apache.activemq:* MBeans, including BrokerService.addNetworkConnector and addConnector. An authenticated attacker can pass a crafted discovery URI whose VM transport brokerConfig parameter loads a remote Spring XML context, and because ResourceXmlApplicationContext instantiates singleton beans before BrokerService validates the configuration, arbitrary code runs in the broker JVM. This matters because it turns a routine management interface into remote code execution on the broker host.

Impact

An attacker with valid credentials gains arbitrary code execution in the broker's JVM, allowing full compromise of the broker process and, depending on its privileges, the underlying host. Confidentiality, integrity and availability are all rated high in the CVSS vector.

Attack surface

Reached over the network through the web console's Jolokia endpoint at /api/jolokia/; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated attacker is required and no user interaction is needed. The flaw is in the default Jolokia access policy combined with the VM transport's brokerConfig handling.

Exploitation

CVE-2026-34197 was added to CISA KEV on 2026-04-16 with a remediation due date of 2026-04-30, and EPSS gives a 30-day probability of 0.98256 (99.9th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is recorded in the KEV entry.

What to do

• Upgrade Apache ActiveMQ to 5.19.4 or 6.2.3, which the vendor states fixes the issue.
• If immediate upgrade is not possible, restrict or disable the Jolokia JMX-HTTP bridge on the web console and tighten its access policy so exec operations on org.apache.activemq:* MBeans are denied.
• Restrict network access to the ActiveMQ web console and Jolokia endpoint to trusted management hosts only.
• Audit and rotate credentials for accounts that can reach the web console, and remove unused or default accounts.
• Monitor for outbound connections from brokers to unexpected hosts, since the exploit loads a remote Spring XML context.

Detection

• Review broker and web console logs for requests to /api/jolokia/ invoking exec on BrokerService.addNetworkConnector or BrokerService.addConnector.
• Alert on discovery URIs containing brokerConfig parameters or references to remote Spring XML resources in broker configuration and logs.
• Monitor broker JVM processes for unexpected child processes or outbound network connections consistent with remote context loading.
• Track ActiveMQ versions in inventory against the fixed releases 5.19.4 and 6.2.3 to find unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.