Security readout for executives and security teams
Plain-English summary
An authenticated attacker can abuse ActiveMQ Classic’s Jolokia management interface to run arbitrary code on the broker server. Successful exploitation could expose messages, alter broker operations, steal secrets, or interrupt service. CISA lists this vulnerability as known exploited, making prompt remediation important.
Executive priority
Treat as an urgent patching priority, especially for internet-accessible or widely reachable management interfaces. Active exploitation, low attack complexity, and potential full compromise of confidentiality, integrity, and availability justify accelerated inventory, containment, and upgrading.
Technical view
The default Jolokia policy permits execution of ActiveMQ MBean operations. Crafted connector configuration can make the VM transport load remote Spring XML; singleton beans are instantiated before configuration validation, enabling code execution inside the broker JVM. Exploitation requires authenticated Jolokia access but no user interaction.
Likely exposure
Affected deployments run ActiveMQ versions before 5.19.4, or 6.0.0 through versions before 6.2.3. Practical exposure is greatest where the web console’s /api/jolokia/ endpoint is reachable and attacker-obtainable credentials can authenticate. The supplied evidence does not quantify exposed installations.
Exploitation context
CISA’s KEV listing supports active exploitation in the wild. The supplied sources do not describe exploitation scale, targeted organizations, observed indicators, or whether compromised credentials were obtained through separate attacks. Authentication reduces exposure but does not remove urgency.
Researcher notes
The critical boundary is authenticated Jolokia MBean execution combined with premature Spring bean instantiation. Assess endpoint reachability, authorization policy, connector-operation telemetry, and whether remote configuration resources were accessed. Avoid assuming every authenticated account can exploit the issue without validating deployment-specific permissions.
Mitigation direction
- Upgrade ActiveMQ 5.x deployments to version 5.19.4 or later.
- Upgrade ActiveMQ 6.x deployments to version 6.2.3 or later.
- Until upgraded, restrict Jolokia and web-console access to trusted administrators and management networks.
- Review the Apache advisory and applicable downstream vendor guidance before deployment.
Validation and detection
- Inventory ActiveMQ Broker, ActiveMQ All, and Apache ActiveMQ package versions.
- Determine whether /api/jolokia/ is reachable from untrusted or broadly accessible networks.
- Review Jolokia activity for unexpected exec operations involving addConnector or addNetworkConnector.
- After upgrading, confirm the running broker reports version 5.19.4, 6.2.3, or later.
- Review authentication records for unusual or compromised administrative access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-34197 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-07T09:01:09.089Z: Reported to Red Hat.
- 2026-04-07T07:50:10.958Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txtCVE reference, apache · vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197CVE reference, CISA-ADP · government-resource
- https://access.redhat.com/security/cve/CVE-2026-34197CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2455869CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.