Type Vulnerability
Hitachi Energy reports a Remote Code Execution vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. Known-exploited catalogue reports exploitation in the wild.
Apache
Apache ActiveMQ Input Validation Flaw Vulnerability
CVE-2026-34197
What this means
This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Apache Activemq and Apache Activemq Broker are in your estate, and treat that as the priority.
Full vendor description
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
Scoring and exploitation
8.8/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~98.3% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Apache ActiveMQ
Weaknesses
CWE-20CWE-94CWE-78
Affected products ()
- Apache Activemq
- Apache Activemq Broker
Show the raw CPE strings (2)
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
References
6 links from the CVE record, grouped by site; the vendor's advisory comes first.
activemq.apache.org1 linkVendor advisory
- CVE-2026-34197-announcement.txt (opens in a new tab)Vendor Advisory
openwall.com1 link
- 3 (opens in a new tab)Mailing List · Third Party Advisory
access.redhat.com1 link
- CVE-2026-34197 (opens in a new tab)Third Party Advisory
bugzilla.redhat.com1 link
- show_bug.cgi (opens in a new tab)Third Party Advisory
security.access.redhat.com1 link
- cve-2026-34197.json (opens in a new tab)Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource