Chained RCE in ActiveMQ Classic Bypasses Authentication
Apache ActiveMQ Classic environments with exposed Jolokia endpoints remain vulnerable to remote code execution even if only one of two related flaws is patched. The newly discovered CVE-2026-34197 allows attackers to invoke management operations that load and execute remote configurations. This flaw can be chained with CVE-2022-41678, which bypasses authentication, enabling attackers to execute arbitrary OS commands remotely.
The vulnerability has existed for 13 years and affects ActiveMQ Classic versions before 5.19.4 and 6.0.0 through 6.2.3. The flaw exploits the Jolokia API's addNetworkConnector operation to load attacker-controlled Spring XML files, triggering remote code execution. The issue was identified by security researchers using AI-assisted analysis and fixed in the latest releases 5.19.4 and 6.2.3.
This chained exploit means patching only one vulnerability does not fully secure ActiveMQ Classic brokers with exposed Jolokia endpoints. Attackers can still bypass authentication and execute code remotely, posing ongoing risk to enterprise and government systems relying on this middleware. The persistence of this flaw for over a decade highlights the complexity of securing interconnected components in messaging platforms.