CT
CyberTimes
← Back to Threat Watch

CVE-2026-34197: 13-Year-Old Apache ActiveMQ RCE Flaw Chains with Auth Bypass — Plus 20 More Threats This Week

A remote code execution vulnerability that has been hiding inside Apache ActiveMQ Classic for 13 years was publicly disclosed this week — and the window between disclosure and active exploitation is n

TL;DR — 15 Second Read

  • CVE-2026-34197 is a CVSS 8.8 remote code execution flaw in Apache ActiveMQ Classic that has lurked undetected for 13 years — it allows attackers to invoke management operations via the Jolokia API and execute OS commands remotely.
  • When chained with CVE-2024-32114, which exposes the Jolokia API without authentication on versions 6.0.0–6.1.1, the combined exploit becomes a zero-credential full RCE — no username or password required at all.
  • The Phorpiex botnet has returned with a hybrid P2P+HTTP architecture hitting 125,000 devices daily, distributing ransomware, crypto clippers, and sextortion spam with worm-like self-propagation across removable and network drives.
  • Cybercrime cost victims over $17.7 billion in 2025 alone — a 26% jump from 2024 — with cryptocurrency investment fraud, business email compromise, and AI-assisted DDoS emerging as the dominant attack vectors this week.
Severity🟠 HIGH
CVSS Score8.4/10
ExploitedYes — active
Fix StatusPatch available
If you run Apache ActiveMQ Classic versions 5.x through 5.19.3 or 6.0.0 through 6.2.2, or use any default admin:admin credentials on exposed brokers

A remote code execution vulnerability that has been hiding inside Apache ActiveMQ Classic for 13 years was publicly disclosed this week — and the window between disclosure and active exploitation is now measured in hours, not days. CVE-2026-34197, carrying a CVSS score of 8.8, allows attackers to trick ActiveMQ's message broker into fetching a remote configuration file and executing arbitrary operating system commands through the Jolokia management API.

What makes this particularly dangerous for information security and network security teams is the chaining potential. When combined with CVE-2024-32114 — which silently strips authentication from the Jolokia API on versions 6.0.0 through 6.1.1 — the result is a fully unauthenticated remote code execution path requiring zero credentials. Any attacker with network access to port 8161 can own the system outright.


Affected products

  • ·Apache ActiveMQ Classic 5.x through 5.19.3
  • ·Apache ActiveMQ Classic 6.0.0 through 6.2.2

How to Fix

Step-by-step remediation

For Apache ActiveMQ remediation, the priority order is: patch first, harden second, monitor third. Upgrading to 5.19.4 or 6.2.3 resolves CVE-2026-34197 directly. If your deployment is on versions 6.0.0–6.1.1, you must also account for CVE-2024-32114 — both vulnerabilities need to be addressed together since they chain.

To harden the Jolokia API while patching is in progress, locate your jolokia-access.xml file under conf/ in your ActiveMQ installation and add a deny block for all remote hosts, allowing only localhost. Additionally, use your network firewall or security group rules to block inbound access to port 8161 from all external sources. Internal access should be limited to your monitoring infrastructure only.

For credential hygiene, use the ActiveMQ web console at http://localhost:8161/admin to change the admin password immediately after locking down external access. Rotate any service account credentials that may have been exposed. If you suspect exploitation has already occurred, check for unusual XML files in the ActiveMQ conf/ directory and review process trees for child processes spawned by the ActiveMQ JVM — a common indicator of web shell or command execution.

For the Phorpiex threat, deploy endpoint detection rules that flag clipboard modification attempts targeting cryptocurrency wallet address patterns. Disable AutoRun on all Windows endpoints to prevent the worm's USB propagation vector.


What happened

CVE-2026-34197 is technically a bypass of an older vulnerability, CVE-2022-41678, which allowed authenticated attackers to write web shells to disk. The new flaw achieves the same outcome through a different route — manipulating Jolokia's exec operation to invoke classPathXmlApplicationContext and load a remote Spring XML configuration file. That file then executes operating system commands in the context of the ActiveMQ process.

The critical detail is the default credential problem. Horizon3.ai's research confirms that admin:admin remains the most common credential pair in production ActiveMQ deployments worldwide. Even without the authentication bypass from CVE-2024-32114, a significant portion of affected systems are trivially exploitable using these defaults. For versions 6.0.0 through 6.1.1 where CVE-2024-32114 also applies, authentication is bypassed entirely — the attacker doesn't even need to guess.

Beyond the Apache flaw, this week's threat landscape was dominated by the return of the Phorpiex botnet in an evolved hybrid form. The new Twizt variant combines traditional HTTP command-and-control polling with a peer-to-peer protocol running over both TCP and UDP, making server takedowns far less effective. With 125,000 new infections daily across Iran, Uzbekistan, China, Kazakhstan, and Pakistan, Phorpiex is actively distributing LockBit Black ransomware, cryptocurrency clipboard hijackers, and high-volume sextortion email spam — while also propagating worm-like across removable drives and scanning for Local File Inclusion vulnerabilities.

Real-World Impact

Apache ActiveMQ is deployed across thousands of enterprise environments globally — in financial services, healthcare, logistics, and government — as a core message broker for internal application communication. A compromised ActiveMQ instance gives attackers a persistent foothold inside the network perimeter with the ability to read messages passing between internal services, pivot laterally, and deploy ransomware or data exfiltration tools.

The broader weekly picture makes the stakes even clearer. The FBI's 2025 Internet Crime Report, released this week, confirms that cybercrime cost victims over $17.7 billion last year — a 26% increase from 2024. Cryptocurrency investment fraud alone accounted for $7.2 billion. Business email compromise cost organizations $3 billion. Sixty-three new ransomware variants emerged in 2025, with Akira, Qilin, LockBit, and Medusa leading attacks against healthcare, manufacturing, and critical infrastructure.

For digital security and computer security teams operating in India specifically, two stories this week carry direct regional relevance. LSPosed-based Android payment fraud is actively targeting Indian UPI and banking apps by gaslighting the Android OS into believing an attacker's device has the victim's SIM card physically present. And the Phorpiex botnet's clipper module has already hit over 2,000 Indian users searching for legitimate proxy software, redirecting cryptocurrency transactions to attacker-controlled wallets.

Technical Details

CVE-2026-34197 exploits the Jolokia JMX-HTTP bridge in Apache ActiveMQ Classic. The attack specifically targets the classPathXmlApplicationContext MBean operation accessible via Jolokia's exec endpoint at /api/jolokia/exec. By supplying a remote URL pointing to an attacker-controlled Spring XML configuration file, the attacker causes the ActiveMQ JVM to instantiate a ClassPathXmlApplicationContext, which evaluates the XML and executes any Spring beans defined within — including those using org.springframework.scripting.groovy.GroovyScriptFactory for arbitrary Groovy/OS command execution. The chain with CVE-2024-32114 works because versions 6.0.0–6.1.1 exposed the Jolokia API without the SecurityManager filter that enforces authentication, making the credential check entirely bypassable. Horizon3.ai researcher Naveen Sunkavally confirmed proof-of-concept exploit code is functional and straightforward to construct. For Phorpiex's Twizt variant: the hybrid C2 architecture uses HTTP polling as a fallback when P2P nodes are unreachable, ensuring operational continuity even when individual C2 servers are taken down by authorities. The clipper module monitors the Windows clipboard via WM_CLIPBOARDUPDATE messages and replaces cryptocurrency addresses matching regex patterns for Bitcoin, Ethereum, Monero, and Litecoin with attacker-controlled addresses stored in an encrypted payload retrieved at runtime.

🛡️ Prevention Tips

Never expose ActiveMQ's web console or Jolokia API to the internet under any circumstances. These management interfaces are designed for internal monitoring only and have a documented history of being the entry point for critical exploits.

Audit your default credentials across all middleware and broker services — not just ActiveMQ. Default credentials like admin:admin are consistently the first thing automated scanners and threat actors check after identifying a service fingerprint.

For the broader threat landscape this week: enable FIDO2 hardware security keys for all high-risk roles, particularly IT help desk staff who are being specifically targeted by UNC6783's social engineering campaigns. Traditional MFA is being bypassed via clipboard hijacking at the Okta login screen.

Treat any software downloaded from GitHub repositories with the same skepticism as email attachments. Fake Claude Code repositories, trojanized Proxifier installers, and malicious TradingView premium packages are all being hosted on GitHub right now and actively served by search engines including Google and Yandex.

Review your Magento store's integrity if you run e-commerce — the PolyShell-based Magecart campaign hit 99 stores in a single wave on April 7, injecting invisible 1x1 SVG skimmers that capture full payment card details before silently redirecting to the real checkout page.


FAQs

How do I know if my Apache ActiveMQ deployment is vulnerable to CVE-2026-34197?

Check your ActiveMQ version from the web console at port 8161 or by running activemq --version. If you're on any 5.x version below 5.19.4 or any 6.x version below 6.2.3, you are vulnerable. Versions 6.0.0–6.1.1 are additionally affected by CVE-2024-32114, making the exploit unauthenticated. Upgrade immediately to 5.19.4 or 6.2.3.


Can this vulnerability be exploited remotely over the internet?

Yes, if your ActiveMQ web console (port 8161) is exposed to the internet. Many deployments have this port inadvertently open through misconfigured cloud security groups. Use Shodan or your cloud provider's security scanner to check whether port 8161 is publicly reachable from your instance.


Is the Phorpiex botnet targeting Indian users specifically?

Phorpiex's primary infection hotspots this week are Iran, Uzbekistan, China, Kazakhstan, and Pakistan. However, the proxy software trojanization campaign (fake Proxifier installers) has hit over 2,000 Kaspersky users with the highest concentration in India and Vietnam. Indian users searching for proxy or VPN tools via Google or Yandex are at elevated risk.


Read Next