Vulnpedia
← All CVEs

CVE-2026-34197

HIGH 8.8 KNOWN EXPLOITED PoC CATALOGUED DETECTION TEMPLATE ALL-YEARS

Published 2026-04-07 · Last modified 2026-08-17 · apache · NVD: Analyzed

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-04-16. Patch or mitigate now.

Exploitation likelihood

98.3%chance of exploitation in 30 days · 100th percentile

● In CISA KEV (2026-04-16)● Catalogued PoC◆ SSVC: exploitation active, automatable no

Impact if exploited

8.8CVSS 3.1 · HIGH · ADP

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Detection templates

Detection checks are listed separately from PoCs.

Resource commands

nuclei -id CVE-2026-34197 -u https://TARGETDetection template — review its checks and affected versions before use.
curl -s https://vulnpedia.com/cve/CVE-2026-34197/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation Red Hat Apache

Products Apache Activemq Broker Apache Activemq All Apache Activemq Red Hat Amq Broker 7 Red Hat Data Grid 8 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Fuse 7 Red Hat Jboss Enterprise Application Platform 7 Red Hat Jboss Enterprise Application Platform 8 Red Hat Jboss Enterprise Application Platform Expansion Pack Activemq Activemq Broker

Weakness (CWE)

  • CWE-20: Improper Input Validation
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • org.apache.activemq:activemq-broker Maven

    pkg:maven/org.apache.activemq/activemq-broker

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 5.19.5
    74 explicitly listed affected versions

    5.10.0, 5.10.1, 5.10.2, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.13.0, 5.13.1, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.14.5, 5.15.0, 5.15.1, 5.15.10, 5.15.11, 5.15.12, 5.15.13, 5.15.14, 5.15.15, 5.15.16, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.16.8, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.17.7, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 5.18.5, 5.18.6, 5.18.7, 5.19.0, 5.19.1, 5.19.2, 5.19.3, 5.19.4, 5.8.0, 5.9.0, 5.9.1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rxpj-7qvf-xv32/GHSA-rxpj-7qvf-xv32.json"
  }
}
    GitHub Advisory Database · GHSA-rxpj-7qvf-xv32 · Updated 2026-09-10T03:50:44.927548510Z
  • org.apache.activemq:activemq-broker Maven

    pkg:maven/org.apache.activemq/activemq-broker

    ECOSYSTEM range
    • Introduced version (included): 6.0.0
    • Fixed boundary (excluded): 6.2.3
    14 explicitly listed affected versions

    6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.2.0, 6.2.1, 6.2.2

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rxpj-7qvf-xv32/GHSA-rxpj-7qvf-xv32.json"
  }
}
    GitHub Advisory Database · GHSA-rxpj-7qvf-xv32 · Updated 2026-09-10T03:50:44.927548510Z
  • org.apache.activemq:activemq-all Maven

    pkg:maven/org.apache.activemq/activemq-all

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 5.19.5
    89 explicitly listed affected versions

    4.1.2, 5.0.0, 5.1.0, 5.10.0, 5.10.1, 5.10.2, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.13.0, 5.13.1, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.14.5, 5.15.0, 5.15.1, 5.15.10, 5.15.11, 5.15.12, 5.15.13, 5.15.14, 5.15.15, 5.15.16, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.16.8, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.17.7, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 5.18.5, 5.18.6, 5.18.7, 5.19.0, 5.19.1, 5.19.2, 5.19.3, 5.19.4, 5.2.0, 5.3.0, 5.3.1, 5.3.2, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.5.0, 5.5.1, 5.6.0, 5.7.0, 5.8.0, 5.9.0, 5.9.1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rxpj-7qvf-xv32/GHSA-rxpj-7qvf-xv32.json"
  }
}
    GitHub Advisory Database · GHSA-rxpj-7qvf-xv32 · Updated 2026-09-10T03:50:44.927548510Z
  • org.apache.activemq:activemq-all Maven

    pkg:maven/org.apache.activemq/activemq-all

    ECOSYSTEM range
    • Introduced version (included): 6.0.0
    • Fixed boundary (excluded): 6.2.3
    14 explicitly listed affected versions

    6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.2.0, 6.2.1, 6.2.2

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rxpj-7qvf-xv32/GHSA-rxpj-7qvf-xv32.json"
  }
}
    GitHub Advisory Database · GHSA-rxpj-7qvf-xv32 · Updated 2026-09-10T03:50:44.927548510Z

Vendor product assessments

  • activemq-broker as a component of Red Hat AMQ Broker 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:maven/org.apache.activemq/activemq-broker

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • activemq-broker as a component of Red Hat Data Grid 8 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:maven/org.apache.activemq/activemq-broker

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j?rpmmod=log4j:2

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j-jcl as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j-jcl?rpmmod=log4j:2

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j-slf4j as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j-slf4j?rpmmod=log4j:2

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j-web as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j-web?rpmmod=log4j:2

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j-jcl as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j-jcl?rpmmod=log4j:2

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j-slf4j as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j-slf4j?rpmmod=log4j:2

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • log4j.src as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/log4j?arch=src

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • activemq-all as a component of Red Hat Fuse 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.activemq/activemq-all

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • activemq-broker as a component of Red Hat Fuse 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.activemq/activemq-broker

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • activemq-broker as a component of Red Hat JBoss Enterprise Application Platform 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.activemq/activemq-broker

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • activemq-broker as a component of Red Hat JBoss Enterprise Application Platform 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.activemq/activemq-broker

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00
  • activemq-broker as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.activemq/activemq-broker

    Red Hat · CVE-2026-34197 · Updated 2026-08-17T11:55:57+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

15 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

178 more source reports

Known Affected Software Configurations

VendorProductVersion range
ApacheActivemq< 5.19.4
ApacheActivemq≥ 6.0.0 and < 6.2.3
ApacheActivemq Broker< 5.19.4
ApacheActivemq Broker≥ 6.0.0 and < 6.2.3

All CVSS metrics

  • HIGH 8.8 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • HIGH 8.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS