English

← Back to list

Apache ActiveMQ High Risk RCE Gap: 5-step completion of attack chain

itadol5j

CVE-2026-34197 gap analysis

Apache ActiveMQ blasts high-risk RCE loophole

Apache ActiveMQ has recently revealed one.High-risk remote code implementation gap(CVE-2026-34197) The assailant can enforce any code through the Jologia JMX-HTTP bridge on the JVM of Broker.

The impact of this loophole is wide, and all users using ActiveMQ 5.x and 6.x versions require immediate attention.

Basic information on loopholes

Properties Details
CVE ID CVE-2026-34197
Serious level High risk (RCE remote code execution)
CWE CWE-20 (inappropriate input validation), CWE-94 (code injection)
Impact Component Apache ActiveMQ Broker
Prerequisite of attack Require certified users

• Affected version

  • Apache ActiveMQ 5.x: All versions < 5.19.4
  • Apache ActiveMQ 6.x:6.0.0 – 6.2.3(excluding 6.2.3)

Rehabilitation version

  • Upgrade to 5.19.4(5.x series recovery version)
  • Upgrade to 6.2.3(6.x series rehabilitation version)

Hole: Five steps to attack.

Step 1: Visit Jolokia Bridge

Apache ActiveMQ Classic was exposed on the Web console. Jologia JMX-HTTP Bridge, the path is /api/jolokia/I don't know. This bridge allows access to the JMX interface via HTTP.

Step 2: Call Mbean exec operation

Default Jologia Access PolicyAllow all ActiveMQ Mbeans(org.apache.activemq:*) perform exec operations. This means that the attackers can call on a variety of ActiveMQ management methods.

Step 3: Constructing malice

The attackers can call. BrokerService.addNetworkConnector(String) or BrokerService.addConnector(String) The method, into the carefully constructed one.That's right.VM transfer trigger BrokerConfig parameter.

Step 4: Load Remote Spring XML

BrokerConfig parameter specifies the load remote Spring XML Apply Context,use ResourceXmlApplicationContextI don't know.

Step 5: Any code execution

The key points are:RessourceXmlApplicationContext has been exemplified before the BrokerService configurationI don't know. The attacker can use a method like: Runtime.exec() On the JVM of brokerExecute any codeI don't know.

Why is this loophole dangerous?

  1. You can use it after authentication.: With an ActiveMQ login number, you can launch an attack.
  2. Full control, broker:RCE loophole means that the assailant has complete control of the JVM of ActiveMQ broker
  3. Implications: ActiveMQ is a medium for business-level news, and many companies are using it.
  4. The attack chain is intact.: Call remote Spring XML → RCE from → Mbean, strike path clear

How?

Upgrade Now

# 升级到修复版本
# 5.x 系列
wget https://activemq.apache.org/activemq-5.19.4

# 6.x 系列
wget https://activemq.apache.org/activemq-6.2.3

Interim mitigation measures

If this cannot be done for the time being, consideration may be given to:

  • Disable Jolokia: Disable Jolokia JMX-HTTP bridge in ActiveMQ configuration
  • Limit Jologia access policy: Modify default policy, disable exec operations
  • Enhancing certification security: Ensure that the authentication certificate for ActiveMQ is not disclosed
  • Network isolation: Limit access to the ActiveMQ Web console

Check for attack.

  • Check the ActiveMQ broker log with an abnormal addConnector/addNetworkConnect call
  • Check for Spring XML loading requests from external networks
  • Monitor the creation of an anomaly process for broker JVM (Runtime.exec)

Summary

CVE-2026-34197 is oneCase of typical unsafe configuration leading to RCE:

  • ActiveMQ default exposed Jologia JMX-HTTP bridge
  • Default policy allows exec operations for all Mbeans
  • The assailant can load remote Spring XML using the brokerConfig parameter
  • Spring exemplify bean before authentication configuration, resulting in RCE

If you are using Apache ActiveMQ, check the version immediately and upgrade it to 5.19.4 or 6.2.3!

High-risk loopholes are repaired without delay.

Official Security Bulletin:https://activmq.apache.org/security-advisors.data/CVE-2026-34197-environment.txt