This alert is part of our Apache ActiveMQ® CVE guide. It covers what the flaw does, when it needs no password, why the original patch no longer protects you, how to look for exploitation, and which version to run.
CVE-2026-34197 Apache ActiveMQ® details at a glance
| Detail | Value |
| Component | Apache ActiveMQ® Classic broker (activemq-broker, activemq-all); Apache’s advisory lists no Apache Artemis™ components |
| Type | Remote code execution through Jolokia (CWE-20, CWE-94) |
| CVSS 3.1 | 8.8 High (scored by CISA-ADP and Red Hat; Apache gives a severity rating only) |
| Apache severity | Important |
| Authentication | Required, except on 6.0.0 to 6.1.1 (see CVE-2024-32114) |
| Affected | Before 5.19.4; 6.0.0 before 6.2.3 |
| First fixed | 5.19.4, 6.2.3 (superseded: see below) |
| Run today | 5.19.11 or 6.3.2 |
| CISA KEV | Added 16 April 2026; federal due date 30 April 2026 |
| Credit | Naveen Sunkavally, Horizon3.ai |
Sources: Apache advisory, NVD.
How the Jolokia RCE works
Jolokia is the bridge that exposes the broker’s JMX management operations over HTTP, at /api/jolokia/ on the web console port (8161 by default). Among those operations are calls on the broker itself, such as addNetworkConnector, which adds a connection to another broker.
An attacker calls that operation with a crafted discovery URI. The URI tells the broker to start an in-process broker over the VM transport, and the VM transport’s brokerConfig parameter points at a Spring XML file on a server the attacker controls. Spring builds the objects in that file before the broker checks the configuration, so code in it runs inside the broker’s Java process.
Horizon3.ai, whose researcher found the flaw, makes the point that each of these features works as designed on its own. The danger comes from chaining them. The researcher also reported that the bug had been in the code for about 13 years, and that he found it with AI-assisted code review (Horizon3.ai disclosure).
When it needs no password: CVE-2024-32114
The flaw needs an authenticated web console user on most versions. On Apache ActiveMQ® 6.0.0 to 6.1.1 it needs nothing. In those releases, CVE-2024-32114 left the API context that holds Jolokia out of the web console’s security constraints, so anyone who could reach port 8161 could call it. Horizon3.ai calls CVE-2026-34197 an effectively unauthenticated RCE on those versions.
On every other affected version, the login requirement is weaker than it looks. The web console ships with admin:admin, and those credentials are often left unchanged. A broker with default credentials and a reachable console is one HTTP request from compromise.
We’ll cover how Jolokia became the recurring weak point in Apache ActiveMQ®, from CVE-2022-41678 to the 2026 follow-ups, in our upcoming post, The Jolokia Problem.
Exploitation and exposure
| Date (2026) | Event |
| 22 Mar | Horizon3.ai reports the flaw to Apache |
| 30–31 Mar | Apache releases 6.2.3 and 5.19.4 |
| 6–7 Apr | Apache advisory and CVE published; Horizon3.ai publishes its analysis |
| 14 Apr | Fortinet sees exploitation attempts peak, per The Hacker News |
| 16 Apr | CISA adds CVE-2026-34197 to the KEV catalog |
| 20 Apr | Shadowserver counts more than 6,400 IP addresses running vulnerable Apache ActiveMQ®, per BleepingComputer |
| 23 Apr | First bypass of the fix published (CVE-2026-40466) |
| 30 Apr | CISA’s federal remediation deadline |
The gap from public disclosure to observed attacks was about a week. Fortinet reported dozens of exploitation attempts. No public report has named the threat actors or their payloads. The attempts did not stop in April: Shadowserver’s honeypots first recorded exploitation of CVE-2026-34197 on 24 April and were still logging it in mid-July 2026 (CIRCL Vulnerability-Lookup).
ProjectDiscovery’s Nuclei library also has a public scanning template for the flaw, listed in its April 2026 template roundup, which defenders can use to test their own brokers.
Need to patch a fleet of brokers this week?
Why 5.19.4 and 6.2.3 are no longer enough
Apache’s fix blocked the VM transport from being added through broker management calls. Within weeks, researchers found other ways to reach the same result:
| CVE | Route back to code execution | Fixed in |
| CVE-2026-40466 | An HTTP discovery connector returns a VM transport URI that skips the new check | 5.19.6, 6.2.5 |
| CVE-2026-45505 | Discovery wrappers such as static:vm:// and masterslave:vm:// pass validation | 5.19.7, 6.2.6 |
| CVE-2026-42588 | The masterslave: discovery URI loads a remote Spring XML config | 5.19.7, 6.2.6 |
Apache titles the first two as bypasses of the CVE-2026-34197 fix. All three need an authenticated user, the same as the original. That makes 5.19.7 / 6.2.6 the minimum for this family.
Those releases also ship a much stricter default Jolokia policy that allows only POST requests and denies broker-management operations such as addNetworkConnector. That policy only protects you if your upgrade keeps the new jolokia-access.xml rather than an older copy.
The practical answer is simpler: run 5.19.11 or 6.3.2. As of October 2026 they are the only releases that fix every 2026 Apache ActiveMQ® advisory, and the only 5.x and 6.x lines Apache still marks as active. The 6.2.x, 6.1.x and 6.0.x lines are end-of-life. We’ll cover how to plan that upgrade in our upcoming Upgrade & Patching Strategy guide.
Who has to act, and by when
Under Binding Operational Directive 22-01, US federal civilian agencies had to fix CVE-2026-34197 by 30 April 2026. The deadline binds no one else. But a KEV listing is a statement that attackers are using the flaw, which is why many security teams use the catalog to set their own patch priorities, and why auditors increasingly ask about it.
Any affected broker whose web console is reachable beyond a locked-down management network is urgent.
How to check whether you were hit
The first four checks come from Horizon3.ai’s analysis and match the detection guidance from Integrity360 and FortiGuard Labs. The fifth is a standard post-compromise check:
- Jolokia calls in web console access logs. Look for POST requests to /api/jolokia/ whose body calls addNetworkConnector.
- Unusual network connectors in broker logs. Connector activity referencing vm:// URIs with brokerConfig=xbean:http should never appear in normal operation. A warning about a failed configuration may follow, but only after the code has already run.
- Outbound HTTP from the broker. The broker process fetching files from unfamiliar hosts is a strong signal.
- Child processes of the Apache ActiveMQ® Java process. Any shell or download tool, such as curl or wget, started by the broker JVM.
- New web console users or changed credentials you cannot account for.
If you find evidence, upgrading is not enough. Isolate the broker, rebuild it from a known-good image, rotate every credential it held, and review what it could reach on the network.
Manage brokers without exposing Jolokia
What to do now
- Upgrade to 5.19.11 or 6.3.2, and confirm the new conf/jolokia-access.xml is in place.
- Take the web console off user networks. Bind port 8161 to 127.0.0.1 or a management interface, and firewall it.
- Replace admin:admin and give non-admin console users no Jolokia access.
- Disable Jolokia if nothing in your estate needs HTTP management.
- Hunt using the five checks above on every broker that ran an affected version while its console was reachable.
Frequently Asked Questions
CVE-2026-34197 is a Jolokia RCE flaw in Apache ActiveMQ® Classic. A user who can call Jolokia, the broker’s HTTP management API, can make the broker load a remote Spring configuration file and run code. It affects versions before 5.19.4 and 6.0.0 before 6.2.3, and CISA added it to its Known Exploited Vulnerabilities catalog on 16 April 2026.
On Apache ActiveMQ® 6.0.0 to 6.1.1, yes. A separate flaw, CVE-2024-32114, left the Jolokia API without authentication by default on those versions. On other affected versions an attacker needs a web console login, and the default admin:admin credentials are often left in place.
Apache’s advisory names 5.19.4 and 6.2.3. Three later CVEs reopened the same route, so the minimum for this family is 5.19.7 or 6.2.6. As of October 2026 the recommended releases are 5.19.11 and 6.3.2, the only versions that fix every 2026 Apache ActiveMQ® advisory.
Apache’s first advisory named 5.19.5 by mistake. On 7 April 2026, Apache corrected it on the project’s users mailing list to 5.19.4 or 6.2.3, and the CVE record now names 5.19.4. Some news reports and databases still carry the old number. The difference no longer matters in practice: neither version closes the later bypasses, so upgrade to 5.19.11 or later.
30 April 2026. Under Binding Operational Directive 22-01, US federal civilian agencies had to remediate it by that date. The deadline does not bind other organizations, but a KEV listing means attackers are using the flaw, so it should be treated as urgent everywhere.
CVE-2026-34197 was patched in March, exploited in April, and reopened three times by summer. Keeping up with that pace across dozens of brokers is the hard part. meshIQ’s Apache ActiveMQ® engineers track every advisory, assess your exposure, and move your brokers to supported releases before the next KEV listing.