CISA tells feds to patch 13-year-old Apache ActiveMQ bug under active attack
(2026/04/17)
- Reference: 1776445791
- News link: https://www.theregister.co.uk/2026/04/17/cisa_tells_feds_to_patch/
- Source link:
CISA is sounding the alarm on a newly-exploited Apache ActiveMQ bug, ordering federal agencies to patch within two weeks as attackers circle a flaw that's been quietly lurking for more than a decade.
The US cybersecurity agency added the bug, tracked as CVE-2026-34197, to its Known Exploited Vulnerabilities (KEV) catalog on Thursday, triggering a Binding Operational Directive (BOD) 22-01 deadline that gives Federal Civilian Executive Branch agencies until April 30 to fix their systems or get ready to explain why not.
The bug sits in Apache ActiveMQ, an open source message broker used to shuttle data between applications and services, and allows an authenticated user to execute arbitrary code via the broker's Jolokia management API – effectively turning a messaging workhorse into a remote command runner.
[1]
It was disclosed [2]just over a week ago by Horizon3 researcher Naveen Sunkavally, who used Anthropic's Claude AI assistant to help dig it out. According to Horizon3, the issue has been sitting in the codebase for 13 years, unnoticed until now. Patches are available in ActiveMQ versions 5.19.5 and 6.2.3.
[3]
[4]
"CVE-2026-34197 is a remote code execution vulnerability in Apache ActiveMQ Classic that has been hiding in plain sight for 13 years," Sunkavally said. "An attacker can invoke a management operation through ActiveMQ's Jolokia API to trick the broker into fetching a remote configuration file and running arbitrary OS commands."
While the bug technically requires authentication, Horizon3 notes that many deployments still rely on default credentials – the ever-reliable "admin:admin" – making initial access trivial. Worse, on certain versions (6.0.0 through 6.1.1), an older flaw, CVE-2024-32114, can expose the Jolokia API without authentication entirely, turning this into a no-credentials-needed remote code execution chain.
[5]
"The vulnerability requires credentials, but default credentials are common in many environments," Sunkavally said. "On some versions… no credentials are required at all… In those versions, CVE-2026-34197 is effectively an unauthenticated RCE."
[6]Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in
[7]Red Hat middleware takes a back seat in strategic shuffle
[8]Encrypted mail service Proton hands suspect's personal info to local cops
[9]Critical Apache ActiveMQ flaw under attack by 'clumsy' ransomware crims
That combination is exactly the sort of thing that lands a bug on CISA's KEV list, which is reserved for vulnerabilities already being exploited in the wild. And there's plenty of exposed surface to aim at: threat monitoring outfit ShadowServer is [10]tracking more than 8,000 ActiveMQ instances reachable from the public internet.
This isn't ActiveMQ's first run-in with attackers, either. The [11]platform has featured in its fair share of compromises , from cryptominers to botnet infrastructure. As Sunkavally pointed out, none of this is especially novel, which puts the onus squarely on admins to move quickly. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/
[7] https://www.theregister.com/2024/05/20/red_hat_prunes_middleware/
[8] https://www.theregister.com/2024/05/13/infosec_in_brief/
[9] https://www.theregister.com/2023/11/02/apache_activemq_vulnerability/
[10] https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=activemq&group_by=geo&style=stacked
[11] https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/
[12] https://whitepapers.theregister.com/
The US cybersecurity agency added the bug, tracked as CVE-2026-34197, to its Known Exploited Vulnerabilities (KEV) catalog on Thursday, triggering a Binding Operational Directive (BOD) 22-01 deadline that gives Federal Civilian Executive Branch agencies until April 30 to fix their systems or get ready to explain why not.
The bug sits in Apache ActiveMQ, an open source message broker used to shuttle data between applications and services, and allows an authenticated user to execute arbitrary code via the broker's Jolokia management API – effectively turning a messaging workhorse into a remote command runner.
[1]
It was disclosed [2]just over a week ago by Horizon3 researcher Naveen Sunkavally, who used Anthropic's Claude AI assistant to help dig it out. According to Horizon3, the issue has been sitting in the codebase for 13 years, unnoticed until now. Patches are available in ActiveMQ versions 5.19.5 and 6.2.3.
[3]
[4]
"CVE-2026-34197 is a remote code execution vulnerability in Apache ActiveMQ Classic that has been hiding in plain sight for 13 years," Sunkavally said. "An attacker can invoke a management operation through ActiveMQ's Jolokia API to trick the broker into fetching a remote configuration file and running arbitrary OS commands."
While the bug technically requires authentication, Horizon3 notes that many deployments still rely on default credentials – the ever-reliable "admin:admin" – making initial access trivial. Worse, on certain versions (6.0.0 through 6.1.1), an older flaw, CVE-2024-32114, can expose the Jolokia API without authentication entirely, turning this into a no-credentials-needed remote code execution chain.
[5]
"The vulnerability requires credentials, but default credentials are common in many environments," Sunkavally said. "On some versions… no credentials are required at all… In those versions, CVE-2026-34197 is effectively an unauthenticated RCE."
[6]Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in
[7]Red Hat middleware takes a back seat in strategic shuffle
[8]Encrypted mail service Proton hands suspect's personal info to local cops
[9]Critical Apache ActiveMQ flaw under attack by 'clumsy' ransomware crims
That combination is exactly the sort of thing that lands a bug on CISA's KEV list, which is reserved for vulnerabilities already being exploited in the wild. And there's plenty of exposed surface to aim at: threat monitoring outfit ShadowServer is [10]tracking more than 8,000 ActiveMQ instances reachable from the public internet.
This isn't ActiveMQ's first run-in with attackers, either. The [11]platform has featured in its fair share of compromises , from cryptominers to botnet infrastructure. As Sunkavally pointed out, none of this is especially novel, which puts the onus squarely on admins to move quickly. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeKthM95hvEshgcT9STQfgAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/
[7] https://www.theregister.com/2024/05/20/red_hat_prunes_middleware/
[8] https://www.theregister.com/2024/05/13/infosec_in_brief/
[9] https://www.theregister.com/2023/11/02/apache_activemq_vulnerability/
[10] https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=activemq&group_by=geo&style=stacked
[11] https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/
[12] https://whitepapers.theregister.com/
A last gasp for CISA
Anonymous Coward
Good to go out on a high before DJT notices it is still around.
Would be interesting
to know the breakdown of these exposed instances, specifically how many are deployed to a cloud provider vs "on prem" (can just look at who owns(WHOIS) the IP spaces of each exposed instance). I'm sort of assuming at least 95-98% are cloud, because I really can't think of a reason why anyone on prem would open a hole in their firewall to an ActiveMQ server(most on prem deployments would be using private IP space internally so would have a NAT/firewall device which you'd have to specifically configure to forward that traffic inbound on). Cloud by contrast is often on a public IP and ignorant users may not enable firewall at all(because they think "who will find this? I'm not an important system"), or they may open it up to the world because they have something else in perhaps another region or AZ or something that needs access and they are too lazy to lock it down more. Or perhaps worse yet opening it to the world so their home computer(on a dynamic IP) can connect to the system directly instead of using a VPN or even a SSH tunnel.
If you are connecting two facilities on prem you're likely using a site to site VPN(you probably could with cloud as well but is less common I am sure) so again no need to expose ActiveMQ to the internet.
I was at an org back in 2009 where we briefly used ActiveMQ for some small things, past decade or so has been RabbitMQ though (all on prem, and of course not exposed externally).