{"id":"activemq-jolokia-code-execution-apr-2026","category":"patch","status":"live","title":"Apache ActiveMQ Classic code-execution flaw CVE-2026-34197 exploited; follow-up bypasses fixed","tldr":"Attackers used a flaw in Apache ActiveMQ Classic's management interface to run code on business servers. Two later flaws bypassed its original fix. Ask IT to install a current supported release, rather than stopping at the March updates.","summary":"Apache ActiveMQ Classic, software that passes messages between business applications, had a management-interface flaw that let an authenticated attacker run code on its server. CISA confirmed exploitation by listing CVE-2026-34197 on 16 April. Apache's current advisory identifies 5.19.4 and 6.2.3 as the original fixes, although its initial announcement recommended 5.19.5 on the 5.x branch. Those updates were not the end of the issue: Apache subsequently disclosed two ways around the protection, CVE-2026-40466 and CVE-2026-45505. Fixes for both were available in 5.19.7 and 6.2.6 by 31 May. The reviewed sources do not establish exploitation of either bypass or identify confirmed victims of the original attacks. As of 3 November, fixes are available and Apache offers newer supported releases: 5.19.12, 6.3.3 and 6.4.0. Its 6.2.x branch is inactive.","action":"Nothing to install on ordinary family phones or computers. If your business or family office runs ActiveMQ Classic, ask IT or the service provider to update to the appropriate current supported release—5.19.12, 6.3.3 or 6.4.0—and check for signs of compromise.","product":"Apache ActiveMQ Classic message broker","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-34197","CVE-2026-40466","CVE-2026-45505"],"tags":["apache","activemq","server","code-execution","exploited","incomplete-fix"],"affected":["CVE-2026-34197: Apache ActiveMQ Broker and ActiveMQ All before 5.19.4; 6.0.0 to before 6.2.3.","CVE-2026-40466: Apache ActiveMQ Broker, ActiveMQ All and Apache ActiveMQ before 5.19.6; 6.0.0 to before 6.2.5. The bypass requires the activemq-http module.","CVE-2026-45505: Apache ActiveMQ Broker, ActiveMQ All and Apache ActiveMQ before 5.19.7; 6.0.0 to before 6.2.6."],"fixed":["CVE-2026-34197: 5.19.4 and 6.2.3, according to Apache's current advisory.","CVE-2026-40466: 5.19.6 and 6.2.5.","CVE-2026-45505: 5.19.7 and 6.2.6."],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-34197 announcement","url":"https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt","by":"Apache Software Foundation","date":"2026-04-06"},{"kind":"advisory","title":"CVE-2026-40466: bypass of CVE-2026-34197 through HTTP discovery","url":"https://activemq.apache.org/security-advisories.data/CVE-2026-40466-announcement.txt","by":"Apache Software Foundation","date":"2026-04-23"},{"kind":"advisory","title":"CVE-2026-45505: Jolokia discovery-wrapper bypass","url":"https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt","by":"Apache Software Foundation","date":"2026-06-01"},{"kind":"post","title":"Original CVE-2026-34197 announcement on oss-security","url":"https://www.openwall.com/lists/oss-security/2026/04/06/3","by":"Apache Software Foundation via oss-security","date":"2026-04-06"},{"kind":"news","title":"Recent Apache ActiveMQ Vulnerability Exploited in the Wild","url":"https://www.securityweek.com/recent-apache-activemq-vulnerability-exploited-in-the-wild/","by":"SecurityWeek","date":"2026-04-17"},{"kind":"news","title":"Actively exploited Apache ActiveMQ flaw impacts 6,400 servers","url":"https://www.bleepingcomputer.com/news/security/actively-exploited-apache-activemq-flaw-impacts-6-400-servers/","by":"BleepingComputer","date":"2026-04-21"},{"kind":"post","title":"ActiveMQ release news","url":"https://activemq.apache.org/news/","by":"Apache Software Foundation","date":"2026-10-27"},{"kind":"post","title":"Download ActiveMQ: current releases and branch status","url":"https://activemq.apache.org/components/classic/download/","by":"Apache Software Foundation","date":"2026-10-27"}],"started":"2026-04-06","closed":null,"created":"2026-11-03T22:24:41.640Z","updated":"2026-11-03T22:24:41.640Z","cve_notes":[{"cve":"CVE-2026-34197","name":"Code execution through ActiveMQ's Jolokia interface","what":"Insufficient validation in ActiveMQ Classic's Jolokia management interface lets an authenticated attacker make the broker load an external configuration and run attacker-controlled code.","severity":"high","cvss":8.8},{"cve":"CVE-2026-40466","name":"HTTP discovery bypass of ActiveMQ's code-execution fix","what":"When the activemq-http module is present, HTTP discovery can bypass ActiveMQ Classic's original validation fix and let an authenticated attacker run code on the broker.","severity":"high","cvss":0},{"cve":"CVE-2026-45505","name":"Discovery-wrapper bypass of ActiveMQ's original fix","what":"Incomplete checking of discovery wrappers in ActiveMQ Classic lets an authenticated attacker bypass the original protection and run code on the broker.","severity":"high","cvss":0}],"timeline":[{"at":"2026-10-27","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Apache released 5.19.12, 6.3.3 and 6.4.0, the current releases on its active branches as of 3 November. The older 6.2.x branch is now inactive.","url":"https://activemq.apache.org/components/classic/download/","by":"Apache Software Foundation","patch":null},{"at":"2026-05-31","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Apache released 5.19.7 and 6.2.6, which fix the further discovery-wrapper bypass tracked as CVE-2026-45505.","url":"https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt","by":"Apache Software Foundation","patch":"patched"},{"at":"2026-04-23","added":"2026-11-03T22:11:23.504Z","kind":"fix-incomplete","text":"Apache released 5.19.6 and 6.2.5 to fix CVE-2026-40466, an HTTP discovery bypass of the original protection when the activemq-http module is present. A further bypass subsequently required another update.","url":"https://activemq.apache.org/security-advisories.data/CVE-2026-40466-announcement.txt","by":"Apache Software Foundation","patch":"partial"},{"at":"2026-04-21","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"BleepingComputer reported Shadowserver's finding of more than 6,400 internet-exposed IP addresses vulnerable to CVE-2026-34197. This was an exposure count, not a count of confirmed compromises.","url":"https://www.bleepingcomputer.com/news/security/actively-exploited-apache-activemq-flaw-impacts-6-400-servers/","by":"BleepingComputer","patch":null},{"at":"2026-04-16","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities catalogue. It required US federal civilian agencies to address it by 30 April.","url":"https://www.securityweek.com/recent-apache-activemq-vulnerability-exploited-in-the-wild/","by":"SecurityWeek","patch":null},{"at":"2026-04-06T13:07Z","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Apache publicly announced CVE-2026-34197: someone authenticated to the web management interface could run code on the broker. This initial announcement recommended 5.19.5 or 6.2.3; Apache's current advisory instead names 5.19.4 for the original 5.x fix.","url":"https://www.openwall.com/lists/oss-security/2026/04/06/3","by":"Apache Software Foundation via oss-security","patch":null},{"at":"2026-03-31","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Apache released ActiveMQ Classic 5.19.4. Its current advisory identifies 5.19.4 and 6.2.3 as the original fixed versions.","url":"https://activemq.apache.org/news/","by":"Apache Software Foundation","patch":"patched"},{"at":"2026-03-30","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Apache released ActiveMQ Classic 6.2.3, the original fix for the affected 6.x versions. The 5.x release followed the next day.","url":"https://activemq.apache.org/news/","by":"Apache Software Foundation","patch":"partial"}],"url":"https://hard.fyi/live/activemq-jolokia-code-execution-apr-2026/","json":"https://hard.fyi/api/live?id=activemq-jolokia-code-execution-apr-2026"}