{"id":233353,"date":"2026-04-16T23:22:00","date_gmt":"2026-04-17T03:22:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/16\/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation\/"},"modified":"2026-04-20T10:45:08","modified_gmt":"2026-04-20T14:45:08","slug":"apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/16\/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation\/","title":{"rendered":"Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation"},"content":{"rendered":"

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/04\/apache-activemq-cve-2026-34197-added-to.html<\/a><\/p>\n

Publish Date: 2026-04-16 23:22:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Apr 17, 2026<\/span><\/span>Vulnerability \/ Enterprise Security<\/span><\/p>\n

A recently disclosed high-severity security flaw in Apache ActiveMQ\u00a0Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency\u00a0(CISA).<\/p>\n

To that end, the agency\u00a0has added the vulnerability, tracked\u00a0as CVE-2026-34197<\/strong> (CVSS score: 8.8), to its Known Exploited Vulnerabilities\u00a0(KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by April 30,\u00a02026.<\/p>\n

CVE-2026-34197\u00a0has been described as a case of improper input validation that could lead to code injection, effectively allowing an attacker to execute arbitrary code on susceptible installations. According\u00a0to Horizon3.ai’s Naveen Sunkavally, CVE-2026-34197 has\u00a0been\u00a0“hiding in plain\u00a0sight” for 13\u00a0years.\u00a0<\/p>\n

“An attacker can invoke a management operation\u00a0through ActiveMQ’s Jolokia API to trick the broker into fetching a remote configuration file and running arbitrary OS\u00a0commands,” Sunkavally\u00a0added.<\/p>\n

“The vulnerability requires credentials, but default credentials (admin:admin) are common in many environments. On some versions (6.0.0\u20136.1.1), no credentials are\u00a0required at\u00a0all due to another vulnerability, CVE-2024-32114, which inadvertently exposes the Jolokia API without authentication. In those versions, CVE-2026-34197 is effectively an unauthenticated\u00a0RCE.”<\/p>\n

The vulnerability impacts the following versions\u00a0–<\/p>\n