CVE-2026-34197

CVE-2026-34197 is a code injection vulnerability in Apache ActiveMQ that exploits improper input validation in the Jolokia JMX-HTTP bridge exposed at /api/jolokia/. An authenticated attacker can invoke the BrokerService.addNetworkConnector or addConnector operations with a malicious Spring XML configuration URI, which triggers arbitrary code execution through Spring bean instantiation before configuration validation occurs. The vulnerability affects Apache ActiveMQ versions before 5.19.4 and versions 6.0.0 through 6.2.2. The vulnerability carries a CVSS 3.1 score of 8.8 (High) with a network attack vector, low complexity, and only low privilege requirements. An authenticated attacker can achieve complete system compromise, including confidentiality, integrity, and availability impacts on the broker's JVM. The EPSS score of 0.625 indicates this vulnerability ranks higher in exploitability than 98.4% of all CVEs. This vulnerability is actively exploited in the wild and appears on the CISA Known Exploited Vulnerabilities catalog with confirmed public exploit code available. The high FAUCET risk score of 96.0 and inclusion on the Hot List indicate significant community attention and real-world threat activity. Apache has released patched versions 5.19.4 and 6.2.3, and immediate patching is strongly recommended for all affected deployments.