VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 13:41 UTC

CVE-2026-34197

Read full description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.8/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.8: +1.32
Fresh EPSS: 98.26%: +0.49

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 14 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

cyfirma

Press · 01 Jun 2026, 07:00 · CVE-2026-34197 Jolokia Exposure Enables RCE in Apache ActiveMQ - cyfirma

BleepingComputer

Press · 21 Apr 2026, 07:00 · Actively exploited Apache ActiveMQ flaw impacts 6,400 servers - BleepingComputer

Check Point Research

Press · 20 Apr 2026, 07:00 · 20th April – Threat Intelligence Report - Check Point Research

SecurityWeek

Press · 17 Apr 2026, 07:00 · Recent Apache ActiveMQ Vulnerability Exploited in the Wild - SecurityWeek

The Register

Press · 17 Apr 2026, 07:00 · CISA tells feds to patch 13-year-old Apache ActiveMQ bug under active attack - The Register

See all 14 source documents

BleepingComputer

Press · 17 Apr 2026, 07:00 · CISA flags Apache ActiveMQ flaw as actively exploited in attacks - BleepingComputer

Security Affairs

Press · 17 Apr 2026, 07:00 · U.S. CISA adds a flaw in Apache ActiveMQ to its Known Exploited Vulnerabilities catalog - Security Affairs

The Hacker News

Press · 17 Apr 2026, 07:00 · Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation - The Hacker News

CCB Belgium

Press · 13 Apr 2026, 07:00 · Warning: High severity vulnerability in Apache ActiveMQ, Patch Immediately! - CCB Belgium

csoonline.com

Press · 10 Apr 2026, 07:00 · Claude uncovers a 13‑year‑old ActiveMQ RCE bug within minutes - csoonline.com

Help Net Security

Press · 09 Apr 2026, 07:00 · Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) - Help Net Security

SecurityWeek

Press · 08 Apr 2026, 07:00 · RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years - SecurityWeek

BleepingComputer

Press · 08 Apr 2026, 07:00 · 13-year-old bug in ActiveMQ lets hackers remotely execute commands - BleepingComputer

Field Effect

Press · 08 Apr 2026, 07:00 · POC Published for Remote Code Execution in Apache ActiveMQ - Field Effect

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 5 repos with metrics

Repository	Stars	Forks	Language	Updated
dinosn/CVE-2026-34197	8	0	Python	08 Apr 2026, 09:26
DEVSECURITYSPRO/CVE-2026-34197	4	0	Python	08 Apr 2026, 20:07
KONDORDEVSECURITYCORP/CVE-2026-34197	2	1	Python	13 Apr 2026, 19:52
nirvanasec/CVE-2026-34197-PoC	0	0	—	04 Sep 2026, 15:44
pssec-io/CVE-2026-34197	0	0	Dockerfile	08 Jul 2026, 11:37

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.8; EPSS 98.3%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, low privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:06.817747+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

07 Apr 2026, 07:50

First press mention

08 Apr 2026, 07:00

Added to the CISA KEV catalog

16 Apr 2026, 00:00

Latest press mention

01 Jun 2026, 07:00

Score calculated

05 Nov 2026, 14:00

PoCs on GitHub

5 repositories