Safety researchers found a distant code execution (RCE) vulnerability in Apache ActiveMQ Traditional that has gone undetected for 13 years and might be exploited to execute arbitrary instructions.
The flaw was uncovered utilizing the Claude AI assistant, which recognized an exploit path by analyzing how independently developed parts work together.
Tracked as CVE-2026-34197, the security concern obtained a excessive severity rating of 8.8 and impacts variations of Apache ActiveMQ/Dealer earlier than 5.19.4, and all variations from 6.0.0 as much as 6.2.3
That is additionally the rationale why it was missed for greater than a decade.
Apache ActiveMQ is an open-source message dealer written in Java that handles asynchronous communication through message queues or subjects.
Though ActiveMQ has launched a more recent ‘Artemis’ department with higher efficiency, the ‘Traditional’ version impacted by CVE-2026-34197 is extensively deployed in enterprise, net backends, authorities, and firm programs constructed on Java.
Horizon3 researcher Naveen Sunkavally discovered the problem “with nothing greater than a few primary prompts” in Claude. “This was 80% Claude with 20% gift-wrapping by a human,” he mentioned.
Sunkavally notes that Claude pointed to the problem after analyzing a number of particular person parts (Jolokia, JMX, community connectors, and VM transports).
“Every function in isolation does what it’s purported to, however they have been harmful collectively. That is precisely the place Claude shone – effectively stitching collectively this path finish to finish with a transparent head freed from assumptions.”
The researcher reported the vulnerability to Apache maintainers on March 22, and the developer addressed it on March 30 in ActiveMQ Traditional variations 6.2.3 and 5.19.4.
A report from Horizon3 explains that the flaw stems from ActiveMQ’s Jolokia administration API exposing a dealer perform (addNetworkConnector) that may be abused to load exterior configurations.
By sending a specifically crafted request, an attacker can power the dealer to fetch a distant Spring XML file and execute arbitrary system instructions throughout its initialization.
The problem requires authentication through Jolokia, however turns into unauthenticated on variations 6.0.0 via 6.1.1 as a result of a separate bug, CVE-2024-32114, which exposes the API with out entry management.
Supply: Horizon3
Horizon3 researchers highlighted the danger posed by the newly disclosed flaw, citing different ActiveMQ CVEs that hackers have focused in real-world assaults.
“We advocate organizations working ActiveMQ deal with this as a excessive precedence, as ActiveMQ has been a repeated goal for real-world attackers, and strategies for exploitation and post-exploitation of ActiveMQ are well-known,” Horizon3 says.
“Each CVE-2016-3088, an authenticated RCE affecting the online console, and CVE-2023-46604, an unauthenticated RCE affecting the dealer port, are on CISA’s KEV checklist.”
Though CVE-2026-34197 isn’t reported as actively exploited, the researchers say that indicators of exploitation are clear within the ActiveMQ dealer logs. They advocate on the lookout for suspicious dealer connections that use the interior transport protocol VM and the brokerConfig=xbean:http:// question parameter.
The command execution happens throughout a number of connection makes an attempt. If a warning message seems a few configuration drawback, the researchers say that the payload has already been executed.
Automated pentesting proves the trail exists. BAS proves whether or not your controls cease it. Most groups run one with out the opposite.
This whitepaper maps six validation surfaces, reveals the place protection ends, and supplies practitioners with three diagnostic questions for any instrument analysis.
