Category: MQ
Blog
IBM MQ Alternatives: When ActiveMQ and Artemis Make Sense
What IBM MQ costs an organisation is a knowable figure. It comes off a renewal statement, an entitlement count or a licensing review, and finance can put a number against it down to the core. What replacing it would save is not knowable in the same way. There is no independent case study in the public record carrying real durations, team sizes and application counts, and every migration timeline in circulation comes from an organisation selling the migration.
Blog
CVE-2025-54539 & CVE-2025-29953: Apache ActiveMQ® .NET Client RCE
Most Apache ActiveMQ® security advice is about the broker. CVE-2025-54539 and CVE-2025-29953 turn that around: the broker attacks the application. A broker that has been compromised, impersonated or simply isn't yours can send a crafted message to an Apache ActiveMQ® .NET client, and the client runs the attacker's code while reading it.
Blog
CVE-2026-34197: Apache ActiveMQ® Jolokia RCE (CISA KEV Alert)
CVE-2026-34197 is a Jolokia RCE flaw in Apache ActiveMQ® Classic, reached through the broker's Jolokia management API. Apache disclosed it on 6 April 2026. Ten days later, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline for US federal agencies of 30 April.
Blog
The Jolokia Problem: Eight CVEs, One Door in Apache ActiveMQ®
The Apache ActiveMQ® Jolokia endpoint has been the route to remote code execution in three separate years. In 2023, it was reflection into the JVM. In 2024, a default configuration left it without a login. In 2026, it was the broker's own management operations, patched in March, exploited in April, and reopened three more times by summer.
Blog
10 Questions to Ask an Apache ActiveMQ® Support Vendor
Deciding to buy open source support for Apache ActiveMQ® is the easy part. Working out which vendor can actually keep a broker alive at three in the morning is considerably harder, because nearly every vendor in this market is vague in exactly the same places.
Blog
Apache ActiveMQ® CVE-2023-46604: DripDropper Exploit Explained
When a CVSS 10.0 vulnerability is published, the expectation is that affected software gets patched within days. When it involves an open-source broker that processes business-critical transactions in enterprise environments, the expectation is that the security teams responsible for those brokers treat it as an emergency. “The attacks exploit a maximum-severity security flaw in Apache