Activemq — CraftedSignal Threat Feed

Apache ActiveMQ Vulnerabilities Allow RCE and XSS

hello@craftedsignal.io — Fri, 24 Apr 2026 09:09:10 +0000

Multiple vulnerabilities in Apache ActiveMQ allow a remote, authenticated attacker to execute arbitrary code or perform cross-site scripting (XSS) attacks. While specific CVEs and attack vectors are not detailed in this advisory, the presence of both RCE and XSS vulnerabilities suggests a high risk to organizations using affected versions of ActiveMQ. Exploitation requires authentication, implying that attackers may need to compromise credentials or exploit other vulnerabilities to gain initial access. This combination of vulnerabilities could lead to complete system compromise, data theft, or service disruption. The lack of specific version information makes it crucial for organizations to identify and patch all potentially vulnerable ActiveMQ instances.

Attack Chain

Initial Access: The attacker gains valid credentials to access the ActiveMQ management console or API, potentially through credential stuffing, phishing, or exploiting other vulnerabilities.
Authentication: The attacker authenticates to the ActiveMQ instance using the compromised credentials.
Vulnerability Exploitation (RCE): The attacker exploits a deserialization or other RCE vulnerability to inject malicious code into the ActiveMQ server. This may involve crafting a specific message or request to trigger the vulnerability.
Code Execution: The injected code executes within the context of the ActiveMQ server process, granting the attacker control over the system.
Privilege Escalation (if necessary): The attacker attempts to escalate privileges to gain root or system-level access, depending on the initial privileges of the ActiveMQ process.
Lateral Movement: The attacker uses the compromised ActiveMQ server as a pivot point to move laterally within the network, targeting other systems and resources.
Vulnerability Exploitation (XSS): Simultaneously or independently, the attacker exploits an XSS vulnerability within the ActiveMQ web console. This may involve injecting malicious JavaScript code into the console.
Impact: The attacker deploys ransomware, exfiltrates sensitive data, or disrupts critical services, depending on their objectives. The XSS vulnerability allows the attacker to steal administrator cookies or inject further malicious content.

Impact

Successful exploitation of these vulnerabilities could lead to complete compromise of the ActiveMQ server, potentially affecting all connected systems and applications. The lack of specifics makes it difficult to determine the exact number of potential victims; however, given the widespread use of ActiveMQ in enterprise environments, the impact could be significant. Consequences include data breaches, service disruption, financial loss, and reputational damage. The combination of RCE and XSS vulnerabilities allows attackers to pursue a wide range of malicious objectives, from data theft to system destruction.

Recommendation

Identify all Apache ActiveMQ instances within your environment and determine their versions.
Consult the Apache ActiveMQ security advisories to identify specific vulnerabilities affecting your versions and apply the necessary patches.
Implement strong authentication and authorization controls to restrict access to the ActiveMQ management console and API.
Deploy the Sigma rule to detect potential exploitation attempts against ActiveMQ instances.
Review and harden the ActiveMQ configuration to minimize the attack surface and reduce the risk of exploitation.
Implement network segmentation to limit the impact of a successful compromise of an ActiveMQ instance.

Apache ActiveMQ Classic RCE via Jolokia API Exploitation

hello@craftedsignal.io — Wed, 08 Apr 2026 14:30:27 +0000

A remote code execution vulnerability, CVE-2026-34197, has been identified in Apache ActiveMQ Classic, an open-source messaging and Integration Patterns server widely used across industries. This vulnerability, present for 13 years, allows attackers to invoke management operations through the Jolokia API and instruct the broker to retrieve a remote configuration file, leading to OS command execution. This is achieved by bypassing CVE-2022-41678, a previous bug that allowed webshell creation. Additionally, CVE-2024-32114 exposes the Jolokia API to unauthenticated users in ActiveMQ versions 6.0.0 through 6.1.1, enabling potential RCE without authentication. The vulnerability affects ActiveMQ Classic deployments and was addressed in versions 5.19.4 and 6.2.3.

Attack Chain

Attacker identifies an Apache ActiveMQ Classic instance running a vulnerable version (prior to 5.19.4 or 6.2.3).
If the instance is running ActiveMQ 6.0.0 through 6.1.1, the attacker leverages CVE-2024-32114 to access the Jolokia API without authentication. Otherwise, the attacker authenticates to the ActiveMQ instance.
The attacker invokes management operations through the Jolokia API to target ActiveMQ’s VM transport feature.
The attacker crafts a VM transport URI referencing a non-existent broker.
ActiveMQ creates the broker and accepts a parameter instructing it to load a configuration from a URL controlled by the attacker.
The attacker hosts a malicious Spring XML configuration file on a remote server.
The ActiveMQ broker retrieves and processes the malicious Spring XML configuration file.
The Spring XML file instantiates bean definitions that execute arbitrary OS commands, achieving remote code execution.

Impact

Successful exploitation of these vulnerabilities could lead to complete compromise of the ActiveMQ server, potentially impacting numerous industries relying on this messaging middleware. Attackers could gain unauthorized access to sensitive data, disrupt message queues, and pivot to other systems within the network. The scope of the impact depends on the ActiveMQ deployment and the attacker’s objectives. Unauthenticated exploitation via CVE-2024-32114 significantly broadens the attack surface.

Recommendation

Upgrade Apache ActiveMQ Classic to versions 5.19.4 or 6.2.3 or later to address CVE-2026-34197.
For ActiveMQ versions 6.0.0 through 6.1.1, verify the configuration and security constraints to ensure the Jolokia API is not exposed without authentication, mitigating CVE-2024-32114.
Deploy the Sigma rule “ActiveMQ Jolokia API Access” to monitor for unauthorized access attempts to the Jolokia API.
Implement network segmentation to limit the blast radius in case of a successful compromise.
Monitor process creation events for suspicious processes spawned by the ActiveMQ Java process, leveraging the “ActiveMQ Suspicious Process Creation” Sigma rule.

Active Exploitation of Apache ActiveMQ RCE Vulnerability (CVE-2023-46604)

hello@craftedsignal.io — Wed, 25 Feb 2026 09:22:01 +0000

CVE-2023-46604 is a critical remote code execution (RCE) vulnerability affecting Apache ActiveMQ message brokers. This vulnerability allows a remote attacker with network access to the ActiveMQ broker to execute arbitrary shell commands by manipulating serialized class types within the OpenWire protocol. The vulnerability affects Apache ActiveMQ versions 5.16.0 before 5.16.7, 5.17.0 before 5.17.6, 5.18.0 before 5.18.3, and before 5.15.16, as well as corresponding versions of the Legacy OpenWire…