Apache ActiveMQ, Client, Broker und Web: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.8
  CVE-2026-34197 Exploited Public exploit Scanner template EPSS 98%

  Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia…

  Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  Apr 7, 2026

  KEV Apr 16, 2026
• Medium 4.3
  CVE-2026-33227

  Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

  Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing message…

  Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Wolfi Maven
  Apr 7, 2026

Revision history

1. 2026-10-07 #6

   Neue Updates aufgenommen

2. 2026-09-13 #5

   Neue Updates von IBM aufgenommen

3. 2026-07-23 #4

   Neue Updates von IBM aufgenommen

4. 2026-04-16 #3

   Aktive Ausnutzung gemeldet

5. 2026-04-15 #2

   CVSS zu CVE-2026-34197 an CISA Wertung angepasst

6. 2026-04-07 #1

   Initiale Fassung

References

• ActiveMQ CVE-2026-33227 announcement vom 2026-04-07
  https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt
• ActiveMQ CVE-2026-34197 announcement vom 2026-04-07
  https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
• PoC CVE-2026-34197
  https://github.com/dinosn/CVE-2026-34197/blob/main/exploit_poc.py
• CVE Record CVE-2026-34197 vom 2026-04-16
  https://www.cve.org/CVERecord?id=CVE-2026-34197
• CISA Known Exploited Vulnerabilities Catalog vom 2026-04-16
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• IBM Security Bulletin 7280950 vom 2026-07-23
  https://www.ibm.com/support/pages/node/7280950
• IBM Security Bulletin 7287209 vom 2026-09-11
  https://www.ibm.com/support/pages/node/7287209
• Absolute Secure Access Security Information vom 2026-10-07
  https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-60-and-insights-for-network-4-50