{"id":45509,"date":"2026-04-17T14:40:54","date_gmt":"2026-04-17T06:40:54","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/17\/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation\/"},"modified":"2026-04-17T14:40:54","modified_gmt":"2026-04-17T06:40:54","slug":"apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/17\/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation\/","title":{"rendered":"Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation"},"content":{"rendered":"
\"Apache<\/a><\/div>\n

A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n

To that end, the agency has added<\/a> the vulnerability, tracked as CVE-2026-34197<\/a><\/strong> (CVSS score: 8.8), to its Known Exploited Vulnerabilities (KEV<\/a>) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by April 30, 2026.<\/p>\n

CVE-2026-34197 has been described<\/a> as a case of improper input validation that could lead to code injection, effectively allowing an attacker to execute arbitrary code on susceptible installations. According to Horizon3.ai’s Naveen Sunkavally, CVE-2026-34197 has been “hiding in plain sight” for 13 years. <\/p>\n

“An attacker can invoke a management operation through ActiveMQ’s Jolokia API to trick the broker into fetching a remote configuration file and running arbitrary OS commands,” Sunkavally added.<\/p>\n

“The vulnerability requires credentials, but default credentials (admin:admin) are common in many environments. On some versions (6.0.0–6.1.1), no credentials are required at all due to another vulnerability, CVE-2024-32114, which inadvertently exposes the Jolokia API without authentication. In those versions, CVE-2026-34197 is effectively an unauthenticated RCE.”<\/p>\n

The vulnerability impacts<\/a> the following versions –<\/p>\n