CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 16 Apr 2026, 9 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 98.3%
EPSS score, percentile 99.9 of all scored records
- How severe?
- 8.8 High
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
Required action (CISA), due 30 Apr 2026: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Which versions are affected?
Affected: before 5.19.4; 6.0.0 up to, not including, 6.2.3; before 5.19.4; 6.0.0 up to, not including, 6.2.3; before 5.19.4; 6.0.0 up to, not including, 6.2.3
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 30 April 2026.
Advisories and patches
Linked from CISA's catalog entry
- https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
- https://nvd.nist.gov/vuln/detail/CVE-2026-34197
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | before 5.19.4 |
| Affected | 6.0.0 up to, not including, 6.2.3 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 5.19.4 |
| Affected | 6.0.0 up to, not including, 6.2.3 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 5.19.4 |
| Affected | 6.0.0 up to, not including, 6.2.3 |
Versions not listed are: unaffected.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities (KEV) catalog on 16 Apr 2026.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 30 Apr 2026.
- The CVE record was published on 7 Apr 2026, 9 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 8.8 (High), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 98.3% (percentile 99.9), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 7 Apr 2026 | CVE record published |
| 16 Apr 2026 | Added to CISA KEV |
| 30 Apr 2026 | CISA due date for the required action |
| 17 Aug 2026 | CVE record last updated |
More exploited Apache vulnerabilities
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
- CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability
- CVE-2024-27348: Apache HugeGraph-Server Improper Access Control Vulnerability