Background exploitation KEV catalog

CVE-2026-34197

Apache ActiveMQ Improper Input Validation Vulnerability

CheckOps priority index

8.3/10 Patch within 24 h

Severity8.8

Probability9.8

Exploitation3/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 98.3% higher than 99.9% of CVEs

CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:

Exploited for 201 days 16 Apr 2026

CISA due date 30 Apr 2026 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 3 / 5

KEV catalog (CISA)16 Apr 2026
Exploited in EUVD (ENISA)16 Apr 2026
Used by ransomwareno
EPSS above 10 %98.3%
No account, over the networkno

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Affected products

Apache ActiveMQApache ActiveMQ BrokerApache ActiveMQ AllActiveMQ

Affected versions

6.0.0 <6.2.3
0 <5.19.4

Weaknesses (CWE)

CWE-20 CWE-94

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

07 Apr 2026
Published
16 Apr 2026
Exploitation reported (ENISA)
16 Apr 2026
Added to the KEV catalog
30 Apr 2026
CISA remediation due date
25 Oct 2026
EPSS peak: 98.3%

References

Other exploited vulnerabilities from the same vendor

CVE-2016-3081Apache Struts Command Injection Vulnerability
8.5 · Rising fast
CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
8.4 · Actively exploited
CVE-2024-38475Apache HTTP Server Improper Escaping of Output Vulnerability
9.0 · Background exploitation
CVE-2025-24813Apache Tomcat Path Equivalence Vulnerability
9.4 · Background exploitation
CVE-2024-45195Apache OFBiz Forced Browsing Vulnerability
9.3 · Background exploitation
CVE-2024-27348Apache HugeGraph-Server Improper Access Control Vulnerability
9.3 · Background exploitation