Main Vulnerability Database Vulnerabilities #VU125787

Code Injection in ActiveMQ - CVE-2026-34197

Published: April 10, 2026 / Updated: May 29, 2026

Vulnerability identifier: #VU125787

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34197

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to code injection in the Jolokia JMX-HTTP bridge and exposed ActiveMQ MBeans when handling authenticated exec operations with a crafted discovery URI. A remote user can invoke BrokerService.addNetworkConnector(String) or BrokerService.addConnector(String) to execute arbitrary code.

The issue is exposed through the web console endpoint at /api/jolokia/, and exploitation causes remote Spring XML application context loading via the VM transport's brokerConfig parameter before configuration validation completes.

Affected software

ActiveMQ
IBM Sterling Control Center
IBM Qradar SIEM
IBM Cognos Command Center
openEuler
activemq-javadoc
activemq

How to mitigate CVE-2026-34197

Install security update from vendor's website.

ActiveMQ - addressed in versions 5.19.4, 6.2.3
IBM Sterling Control Center - addressed in versions 6.3.1.0.8, 6.4.1.0.2, 6.4.2.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 15 IF05
IBM Cognos Command Center - update to 10.2.5 FP1 IF4
activemq-javadoc - addressed in versions 5.19.6-1, 5.19.7-1
activemq - addressed in versions 5.19.6-1, 5.19.7-1

Links to Public Exploits and PoC-codes

External References

https://lists.apache.org/api/email.lua?id=zf08410rvswvdx1sqlvp4x6kz5x8x2qg