{"id":627,"date":"2026-04-17T04:27:01","date_gmt":"2026-04-17T04:27:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=627"},"modified":"2026-04-17T04:27:01","modified_gmt":"2026-04-17T04:27:01","slug":"apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=627","title":{"rendered":"Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 17, 2026<\/span><\/span>Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A recently disclosed high-severity security flaw in Apache ActiveMQ\u00a0Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency\u00a0(CISA).<\/p>\n

To that end, the agency\u00a0has added<\/a> the vulnerability, tracked\u00a0as CVE-2026-34197<\/a><\/strong> (CVSS score: 8.8), to its Known Exploited Vulnerabilities\u00a0(KEV<\/a>) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by April 30,\u00a02026.<\/p>\n

CVE-2026-34197\u00a0has been described as a case of improper input validation that could lead to code injection, effectively allowing an attacker to execute arbitrary code on susceptible installations. According\u00a0to Horizon3.ai’s Naveen Sunkavally, CVE-2026-34197 has\u00a0been\u00a0\u00abhiding in plain\u00a0sight\u00bb for 13\u00a0years.\u00a0<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abAn attacker can invoke a management operation\u00a0through ActiveMQ’s Jolokia API to trick the broker into fetching a remote configuration file and running arbitrary OS\u00a0commands,\u00bb Sunkavally\u00a0added.<\/p>\n

\u00abThe vulnerability requires credentials, but default credentials (admin:admin) are common in many environments. On some versions (6.0.0\u20136.1.1), no credentials are\u00a0required at\u00a0all due to another vulnerability, CVE-2024-32114, which inadvertently exposes the Jolokia API without authentication. In those versions, CVE-2026-34197 is effectively an unauthenticated\u00a0RCE.\u00bb<\/p>\n

The vulnerability impacts<\/a> the following versions\u00a0–<\/p>\n