NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksUpdated

Apache ActiveMQ Classic code-execution flaw CVE-2026-34197 exploited; follow-up bypasses fixed

Attackers used a flaw in Apache ActiveMQ Classic's management interface to run code on business servers. Two later flaws bypassed its original fix. Ask IT to install a current supported release, rather than stopping at the March updates.

What to do

Nothing to install on ordinary family phones or computers. If your business or family office runs ActiveMQ Classic, ask IT or the service provider to update to the appropriate current supported release—5.19.12, 6.3.3 or 6.4.0—and check for signs of compromise.

What’s happening

Apache ActiveMQ Classic, software that passes messages between business applications, had a management-interface flaw that let an authenticated attacker run code on its server. CISA confirmed exploitation by listing CVE-2026-34197 on 16 April. Apache's current advisory identifies 5.19.4 and 6.2.3 as the original fixes, although its initial announcement recommended 5.19.5 on the 5.x branch. Those updates were not the end of the issue: Apache subsequently disclosed two ways around the protection, CVE-2026-40466 and CVE-2026-45505. Fixes for both were available in 5.19.7 and 6.2.6 by 31 May. The reviewed sources do not establish exploitation of either bypass or identify confirmed victims of the original attacks. As of 3 November, fixes are available and Apache offers newer supported releases: 5.19.12, 6.3.3 and 6.4.0. Its 6.2.x branch is inactive.

What
Flaw
Affects
Apache ActiveMQ Classic message broker
Affected
CVE-2026-34197: Apache ActiveMQ Broker and ActiveMQ All before 5.19.4; 6.0.0 to before 6.2.3.
CVE-2026-40466: Apache ActiveMQ Broker, ActiveMQ All and Apache ActiveMQ before 5.19.6; 6.0.0 to before 6.2.5. The bypass requires the activemq-http module.
CVE-2026-45505: Apache ActiveMQ Broker, ActiveMQ All and Apache ActiveMQ before 5.19.7; 6.0.0 to before 6.2.6.
Fixed in
CVE-2026-34197: 5.19.4 and 6.2.3, according to Apache's current advisory.
CVE-2026-40466: 5.19.6 and 6.2.5.
CVE-2026-45505: 5.19.7 and 6.2.6.
CVE
CVE-2026-34197, CVE-2026-40466, CVE-2026-45505
Since
6 Apr 2026

Timeline

  1. Update

    Apache released 5.19.12, 6.3.3 and 6.4.0, the current releases on its active branches as of 3 November. The older 6.2.x branch is now inactive.

  2. New fixFixed

    Apache released 5.19.7 and 6.2.6, which fix the further discovery-wrapper bypass tracked as CVE-2026-45505.

  3. Fix incompletePartly fixed

    Apache released 5.19.6 and 6.2.5 to fix CVE-2026-40466, an HTTP discovery bypass of the original protection when the activemq-http module is present. A further bypass subsequently required another update.

  4. Update

    BleepingComputer reported Shadowserver's finding of more than 6,400 internet-exposed IP addresses vulnerable to CVE-2026-34197. This was an exposure count, not a count of confirmed compromises.

  5. CISA added

    CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities catalogue. It required US federal civilian agencies to address it by 30 April.

  6. Made public

    Apache publicly announced CVE-2026-34197: someone authenticated to the web management interface could run code on the broker. This initial announcement recommended 5.19.5 or 6.2.3; Apache's current advisory instead names 5.19.4 for the original 5.x fix.

  7. New fixFixed

    Apache released ActiveMQ Classic 5.19.4. Its current advisory identifies 5.19.4 and 6.2.3 as the original fixed versions.

  8. New fixPartly fixed

    Apache released ActiveMQ Classic 6.2.3, the original fix for the affected 6.x versions. The 5.x release followed the next day.

Sources

  1. CVE-2026-34197 announcementApache Software Foundation · 6 Apr 2026
  2. CVE-2026-40466: bypass of CVE-2026-34197 through HTTP discoveryApache Software Foundation · 23 Apr 2026
  3. CVE-2026-45505: Jolokia discovery-wrapper bypassApache Software Foundation · 1 June 2026
  4. Original CVE-2026-34197 announcement on oss-securityApache Software Foundation via oss-security · 6 Apr 2026
  5. Recent Apache ActiveMQ Vulnerability Exploited in the WildSecurityWeek · 17 Apr 2026
  6. Actively exploited Apache ActiveMQ flaw impacts 6,400 serversBleepingComputer · 21 Apr 2026
  7. ActiveMQ release newsApache Software Foundation · 27 Oct 2026
  8. Download ActiveMQ: current releases and branch statusApache Software Foundation · 27 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS