CVE-2026-34197 Apache Software Foundation Apache ActiveMQ…
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default…
- CVSS
- 8.8 High
- EPSS
- 98%
- Percentile
- 100
- Published
- 2026-04-07
- Force
- 10 of 12
- Public PoC
- 14
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
Apache ActiveMQ Improper Input Validation Vulnerability
- Added
- 2026-04-16
- Federal patch deadline
- 2026-04-30
- Ransomware use
- not known