Recent Apache ActiveMQ Vulnerability Exploited in the Wild

Overview

CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ, is under active exploitation following its public disclosure in early April 2026. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on April 17, 2026, mandating that Federal Civilian Executive Branch (FCEB) agencies patch affected systems by April 30, 2026.

The vulnerability has existed in the ActiveMQ codebase for 13 years before its discovery and exploits the Jolokia management API — a Java Management Extensions (JMX) bridge commonly exposed in default ActiveMQ deployments.

Technical Details

CVE-2026-34197 is an improper input validation and code injection flaw in Apache ActiveMQ Classic. The attack vector targets the Jolokia API endpoint, which exposes JMX management operations over HTTP.

Exploitation mechanism:

1. Attacker identifies a publicly accessible Jolokia endpoint on an ActiveMQ instance
2. Attacker invokes a management operation to trick the broker into fetching a remote configuration file
3. The broker processes the malicious configuration, resulting in arbitrary operating system command execution on the host

While authentication is normally required to reach Jolokia management endpoints, default credentials (admin:admin) are widely present in production deployments, and CVE-2024-32114 (affecting versions 6.0.0–6.1.1) removes authentication requirements entirely, making those versions trivially exploitable with no credential requirement.

Active Exploitation

Telemetry data from Fortinet FortiGuard Labs documented dozens of exploitation attempts against exposed Jolokia endpoints, with activity peaking on April 14, 2026 — three days before CISA's KEV addition. Threat actors are actively scanning for:

• Exposed Jolokia API endpoints (/api/jolokia/ or /jolokia/)
• Instances running default admin credentials
• Versions affected by CVE-2024-32114 (unauthenticated access)

The combination of a long-resident vulnerability, widespread default credentials, and a well-understood exploitation path makes this a high-priority target for automated scanning and opportunistic exploitation.

Affected Versions

Remediation

Upgrade immediately to a fixed version:

• Apache ActiveMQ Classic 6.2.3 or later
• Apache ActiveMQ Classic 5.19.4 or later

Additional mitigations:

1. Disable or restrict Jolokia endpoints — if the Jolokia management API is not required, disable it or restrict access to trusted management networks only
2. Change default credentials — immediately replace default admin:admin credentials on all ActiveMQ instances
3. Network segmentation — ensure ActiveMQ management interfaces are not exposed to the public internet
4. Audit exposed instances — use internal scanning to identify all ActiveMQ deployments and verify patch status
5. Monitor for exploitation — watch for unusual HTTP requests to /jolokia/ endpoints and unexpected outbound connections from ActiveMQ hosts

CISA KEV Mandate

CISA's addition of CVE-2026-34197 to the Known Exploited Vulnerabilities catalog carries a federal patching mandate:

Non-federal organizations should treat this timeline as a target given active exploitation in the wild.

References

• CISA KEV — CVE-2026-34197
• SecurityWeek — Recent Apache ActiveMQ Vulnerability Exploited in the Wild
• Horizon3.ai — CVE-2026-34197 Technical Analysis

Related Reading

• 13-Year-Old Bug in ActiveMQ Lets Hackers Remotely Execute
• CISA Flags Actively Exploited n8n RCE Bug as 24,700
• CVE-2025-68613: n8n Remote Code Execution via Improper