CVE-2026-34197 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-34197HIGH

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .9722   99.9   YES

AFFECTED
  Product                 Versions     Fixed
  Apache ActiveMQ Broker  unspecified  —
  Apache ActiveMQ All     unspecified  —
  Apache ActiveMQ         unspecified  —

TIMELINE
  Mar 26  Reserved by apache
  Apr 7   Published (CNA: apache)
  Apr 16  Added to CISA KEV, remediation due 2026-04-30

CWE-20, CWE-94 · CNA: apache · CVSS v3.1 · 6 references · NVD status: Analyzed · KEV due April 30, 2026

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 26, 2026	Reserved	Reserved by apache
April 7, 2026	Published	Published (CNA: apache)
April 16, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-04-30

Affected

Affected products and packages — 3 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Apache Software Foundation	Apache ActiveMQ Broker	Maven	—	—
Apache Software Foundation	Apache ActiveMQ All	Maven	—	—
Apache Software Foundation	Apache ActiveMQ	Maven	—	—

Weaknesses

CWE-20 · CWE-94

References (6)

http://www.openwall.com/lists/oss-security/2026/04/06/3
https://access.redhat.com/security/cve/CVE-2026-34197 [vdb-entry, x_refsource_REDHAT]
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt [vendor-advisory]
https://bugzilla.redhat.com/show_bug.cgi?id=2455869 [issue-tracking, x_refsource_REDHAT]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json [x_sadp-csaf-vex]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197 [government-resource]

Authoritative record: CVE-2026-34197 at cve.org

Vendors: apache

Weaknesses: CWE-20 · CWE-94

Ecosystems: Maven

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-34197 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.