Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-11864

Опубликовано: 24 апр. 2026
Источник: fstec
CVSS3: 8.8
CVSS2: 9
EPSS Низкий

Описание

Уязвимость компонента Jolokia программных продуктов Apache ActiveMQ связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Вендор

Apache Software Foundation
Axiom JDK

Наименование ПО

Apache ActiveMQ Broker
Apache ActiveMQ
Libercat EE Certified

Версия ПО

до 5.19.4 (Apache ActiveMQ Broker)
от 6.0.0 до 6.2.3 (Apache ActiveMQ Broker)
до 5.19.4 (Apache ActiveMQ)
от 6.0.0 до 6.2.3 (Apache ActiveMQ)
до 8.0.16-39 (Libercat EE Certified)
до 9.1.3-23 (Libercat EE Certified)

Тип ПО

Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Axiom JDK Libercat EE Certified до 8.0.16-39
Axiom JDK Libercat EE Certified до 9.1.3-23

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 9)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 8,8)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 92%
0.04783
Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Связанные уязвимости

CVSS3: 8.8
ubuntu
5 месяцев назад

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, fro...

CVSS3: 8.8
redhat
5 месяцев назад

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, fro...

CVSS3: 8.8
nvd
5 месяцев назад

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, f

CVSS3: 8.8
debian
5 месяцев назад

Improper Input Validation, Improper Control of Generation of Code ('Co ...

CVSS3: 8.8
redos
2 месяца назад

Уязвимость apache-activemq

EPSS

Процентиль: 92%
0.04783
Низкий

8.8 High

CVSS3

9 Critical

CVSS2