CVE-2026-34197
Known exploited · CISA KEV
CVSS 8.8 HIGH: improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ… EPSS 98% (100th percentile).
CISA federal remediation date Apr 30
Vulnerabilities · 159 days ago
Apache ActiveMQ Classic environments with exposed Jolokia endpoints remain vulnerable to remote code execution even if only one of two related flaws is patched. The newly discovered CVE-2026-34197 allows attackers to invoke management operations that load and execute remote configurations. This flaw can be chained with CVE-2022-41678, which bypasses authentication, enabling attackers to execute arbitrary OS commands remotely.
The vulnerability has existed for 13 years and affects ActiveMQ Classic versions before 5.19.4 and 6.0.0 through 6.2.3. The flaw exploits the Jolokia API's addNetworkConnector operation to load attacker-controlled Spring XML files, triggering remote code execution. The issue was identified by security researchers using AI-assisted analysis and fixed in the latest releases 5.19.4 and 6.2.3.
This chained exploit means patching only one vulnerability does not fully secure ActiveMQ Classic brokers with exposed Jolokia endpoints. Attackers can still bypass authentication and execute code remotely, posing ongoing risk to enterprise and government systems relying on this middleware. The persistence of this flaw for over a decade highlights the complexity of securing interconnected components in messaging platforms.
Known exploited · CISA KEV
CVSS 8.8 HIGH: improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ… EPSS 98% (100th percentile).
CISA federal remediation date Apr 30
3 sources covering this story
Researcher used Claude to unearth CVE-2026-34197, an Apache ActiveMQ vulnerability that's been introduced in the codebase 13 years ago.
RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years
The vulnerability requires authentication for successful exploitation, but another flaw exposes the Jolokia API without authentication.
13-year-old bug in ActiveMQ lets hackers remotely execute commands
Security researchers discovered a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that has gone undetected for 13 years and could be exploited to execute arbitrary commands.
Part of the PlainSec briefing for 2026-04-09