Critical Vulnerability in Apache ActiveMQ Classic
Summary
The Cyber Security Agency of Singapore issued an urgent advisory alerting users to a critical code injection vulnerability (CVE-2026-34197) in Apache ActiveMQ Classic. The flaw affects versions 5.x prior to 5.19.4 and versions 6.0.0 through 6.2.2. Successful exploitation could allow authenticated attackers to perform arbitrary code execution, with unauthenticated exploitation possible on versions 6.0.0 through 6.1.1 when chained with CVE-2024-32114, potentially resulting in full system compromise.
What changed
CSA Singapore released a critical cybersecurity advisory regarding CVE-2026-34197, a code injection vulnerability in Apache ActiveMQ Classic. The vulnerability affects all versions prior to 5.19.4 and versions 6.0.0 through 6.2.2. On affected versions, successful exploitation allows authenticated attackers to execute arbitrary code, while versions 6.0.0 through 6.1.1 can be exploited by unauthenticated attackers when chained with CVE-2024-32114, potentially enabling full system compromise.
Organizations using Apache ActiveMQ Classic or Broker must update to the latest patched versions immediately to mitigate remote code execution risks. Security teams should prioritize patching and verify no unauthorized access has occurred on systems running affected versions.
What to do next
- Update Apache ActiveMQ Classic to latest versions immediately
- Apply updates to Apache ActiveMQ Broker versions prior to 5.19.4 and 6.0.0-6.2.2
Archived snapshot
Apr 13, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Alerts
Critical Vulnerability in Apache ActiveMQ Classic
13 April 2026
Apache has released security updates to address a critical vulnerability in Apache ActiveMQ Classic. Users and administrators of affected products are advised to update to the latest versions immediately.
Background
Apache has released security updates to address a code injection vulnerability (CVE-2026-34197) affecting Apache ActiveMQ Classic.
Impact
Successful exploitation of this vulnerability could allow an authenticated attacker to perform arbitrary code execution on the affected system. On versions 6.0.0 through 6.1.1, when chained with CVE-2024-32114, the vulnerability can be exploited by an unauthenticated attacker, potentially resulting in full compromise of the affected system.
Affected Products
This vulnerability affects the following Apache ActiveMQ Classic versions:
Apache ActiveMQ versions prior to 5.19.4
Apache ActiveMQ versions 6.0.0 through 6.2.2
Apache ActiveMQ Broker versions prior to 5.19.4
Apache ActiveMQ Broker versions 6.0.0 through 6.2.2
Mitigation
Users and administrators of affected products are advised to update to the latest versions immediately.
References
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
https://nvd.nist.gov/vuln/detail/CVE-2026-34197
https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/
Related changes
Get daily alerts for CSA Alerts & Advisories (Singapore)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CSA Alerts & Advisories (Singapore) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.