CVE-2026-34197

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 15,5%

Kerentanan Improper Input Validation pada apache activemq, apache activemq broker. Skor CVSS 3.1 8.8 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 16 April 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Rincian

Terbit di NVD

7 April 2026

Terakhir diubah

4 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

15,5% peluang dieksploitasi; lebih tinggi dari 96,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache ActiveMQ Improper Input Validation Vulnerability

Masuk KEV

16 April 2026

Tenggat CISA

30 April 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197 pemerintah AS
• http://www.openwall.com/lists/oss-security/2026/04/06/3 mailing list · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-34197 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2455869 advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json advisory pihak ketiga