CISA Warns of Actively Exploited Apache ActiveMQ Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical vulnerability in Apache ActiveMQ that is currently being exploited in active attacks. The flaw, tracked as CVE-2026-34197, was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant and has gone undetected for 13 years.

The Vulnerability and Its Impact

The security flaw stems from improper input validation in Apache ActiveMQ, the most popular open-source Java-based message broker for asynchronous communication between applications. This vulnerability allows authenticated threat actors to execute arbitrary code via injection attacks, making it particularly dangerous for organizations that rely on ActiveMQ for critical messaging infrastructure.

Apache maintainers addressed the issue on March 30, releasing patches in ActiveMQ Classic versions 6.2.3 and 5.19.4. However, the vulnerability has already been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, indicating that malicious actors are actively leveraging it in the wild.

Active Exploitation and Exposed Systems

Threat monitoring service ShadowServer is currently tracking more than 7,500 Apache ActiveMQ servers exposed online, creating a significant attack surface for threat actors. The widespread deployment of ActiveMQ, combined with the severity of this vulnerability, has prompted CISA to take immediate action.

On Thursday, CISA mandated that Federal Civilian Executive Branch (FCEB) agencies patch their ActiveMQ servers within two weeks, by April 30, as required by Binding Operational Directive (BOD) 22-01. This directive applies specifically to U.S. federal agencies but serves as a critical warning to organizations across all sectors.

Detection and Mitigation

Horizon3 researchers have provided guidance for detecting potential exploitation attempts. Organizations should analyze their ActiveMQ broker logs for suspicious broker connections that use the brokerConfig=xbean:http:// query parameter and the internal transport protocol VM. These indicators can help identify whether systems have already been targeted.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned. The agency recommends applying vendor-provided mitigations, following BOD 22-01 guidance for cloud services, or discontinuing use of the product if patches are unavailable.

Historical Context and Previous Attacks

This is not the first time Apache ActiveMQ has been targeted by threat actors. CISA has previously flagged two other ActiveMQ vulnerabilities as exploited in the wild: CVE-2023-46604 and CVE-2016-3088. The 2023 vulnerability was notably targeted by the TellYouThePass ransomware gang as a zero-day flaw, demonstrating the continued interest of malicious actors in exploiting ActiveMQ weaknesses.

The discovery of CVE-2026-34197 using AI assistance marks a significant development in vulnerability research. The use of Claude AI by Horizon3 researcher Naveen Sunkavally highlights how artificial intelligence is becoming an increasingly valuable tool in identifying security flaws that have remained hidden for years.

Recommendations for Organizations

While BOD 22-01 applies only to U.S. federal agencies, CISA strongly urges private-sector defenders to prioritize patching for CVE-2026-34197. Given ActiveMQ's widespread use in enterprise environments and the proven track record of attackers targeting this platform, organizations should treat this vulnerability as a high priority.

The cybersecurity agency also recommends securing networks as soon as possible and maintaining vigilance for signs of exploitation. With over 7,500 exposed servers currently online, the window for potential compromise remains open for many organizations that have not yet applied the necessary patches.

As cyber threats continue to evolve and attackers become more sophisticated in their exploitation techniques, the discovery and rapid patching of vulnerabilities like CVE-2026-34197 demonstrate the critical importance of proactive security measures and timely vulnerability management in protecting organizational infrastructure.