high8.8Known exploited
CVE-2026-34197
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-04-16. Federal due date: 2026-04-30.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.activemq:activemq-broker | < 5.19.5 | 5.19.5 |
| maven | org.apache.activemq:activemq-all | < 5.19.5 | 5.19.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Activemq | before 5.19.4 from 6.0.0 before 6.2.3 |
| Apache | Activemq Broker | before 5.19.4 from 6.0.0 before 6.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
- http://www.openwall.com/lists/oss-security/2026/04/06/3
- https://access.redhat.com/security/cve/CVE-2026-34197
- https://bugzilla.redhat.com/show_bug.cgi?id=2455869
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197
- https://github.com/advisories/GHSA-rxpj-7qvf-xv32
- https://nvd.nist.gov/vuln/detail/CVE-2026-34197