CVE-2024-32114
published 2024-05-02CVE-2024-32114: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It…
PriorityP181high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.92%
93.4th percentile
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | >= 6.0.0 < 6.1.2 | 6.1.2 |
| apache_software_foundation | apache_activemq | 6.0.0 – 6.1.1 | — |
| debian | activemq | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/api/jolokia/search/org.apache.activemq:type=Broker,*
- →Look for suspicious broker connections in ActiveMQ broker logs that use the internal transport protocol VM and the brokerConfig=xbean:http:// query parameter, which indicates chained exploitation with CVE-2026-34197. ↗
- →CVE-2024-32114 enables unauthenticated access to the Jolokia API on ActiveMQ versions 6.0.0 through 6.1.1, making it a prerequisite chain step for unauthenticated RCE via CVE-2026-34197. Audit all deployments for externally accessible Jolokia endpoints. ↗
- →Shodan/FOFA queries can identify exposed ActiveMQ instances: shodan-query 'http.title:"ActiveMQ"' and fofa-query 'title="ActiveMQ"'.
- →If a warning message appears in ActiveMQ broker logs about a configuration problem during connection attempts using the VM transport, the payload from chained exploitation has already been executed. ↗
- ·The vulnerability only affects Apache ActiveMQ 6.x (specifically 6.0.0 through 6.1.1); the default conf/jetty.xml does not enforce authentication on the /api/ web context. Upgrading to 6.1.2+ or manually adding authentication to conf/jetty.xml mitigates the issue. ↗
- ·Default credentials (admin:admin) are common in many ActiveMQ environments, which further lowers the bar for exploitation even on versions not affected by CVE-2024-32114. ↗
- ·Red Hat's packaged versions of activemq-broker (AMQ Broker 7, AMQ Clients, Camel, Fuse, Data Grid, JBoss EAP, etc.) are listed as Not Affected by CVE-2024-32114. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
vendor_debian8.5LOW
vendor_oracle8.5HIGH
vendor_redhat8.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Authentication (Apache ActiveMQ) — CVE-2024-32114
vendor_oracle·2024-10-15·CVSS 8.5
CVE-2024-32114 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Authentication (Apache ActiveMQ) — CVE-2024-32114
Oracle Oracle Financial Services Applications Risk Matrix: Authentication (Apache ActiveMQ) vulnerability
CVE: CVE-2024-32114
CVSS: 8.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Adjacent
Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache ActiveMQ) — CVE-2024-32114
vendor_oracle·2024-07-15·CVSS 8.5
CVE-2024-32114 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache ActiveMQ) — CVE-2024-32114
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache ActiveMQ) vulnerability
CVE: CVE-2024-32114
CVSS: 8.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Adjacent
Network
Advisory: cpujul2024 (JUL 2024)
Red Hat
activemq-broker: Jolokia and REST API were not secured with default configuration
vendor_redhat·2024-05-01·CVSS 8.5
CVE-2024-32114 [HIGH] CWE-1188 activemq-broker: Jolokia and REST API were not secured with default configuration
activemq-broker: Jolokia and REST API were not secured with default configuration
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
A flaw was found in Apache ActiveMQ. This vulnerability co
Debian
CVE-2024-32114: activemq - In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web con...
vendor_debian·2024·CVSS 8.5
CVE-2024-32114 [HIGH] CVE-2024-32114: activemq - In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web con...
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
Scope: local
bookworm: resolved
bullseye: resolved
sid: resolved
trixie: resolved
GHSA
Apache ActiveMQ's default configuration doesn't secure the API web context
ghsa·2024-05-02
CVE-2024-32114 [HIGH] CWE-1188 Apache ActiveMQ's default configuration doesn't secure the API web context
Apache ActiveMQ's default configuration doesn't secure the API web context
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
OSV
Apache ActiveMQ's default configuration doesn't secure the API web context
osv·2024-05-02
CVE-2024-32114 [HIGH] Apache ActiveMQ's default configuration doesn't secure the API web context
Apache ActiveMQ's default configuration doesn't secure the API web context
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
VulnCheck
Apache ActiveMQ Initialization of a Resource with an Insecure Default
vulncheck·2024·CVSS 8.8
CVE-2024-32114 [HIGH] Apache ActiveMQ Initialization of a Resource with an Insecure Default
Apache ActiveMQ Initialization of a Resource with an Insecure Default
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
Affected: Apache ActiveMQ
Required Action: Apply remediations or mi
No detection rules found.
Nuclei
Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
nuclei·CVSS 8.8
CVE-2024-32114 [HIGH] Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication.
Template:
id: CVE-2024-32114
info:
name: Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
author: ChrisJr404
severity: high
description: |
Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication.
impact: |
Unauthenticated users can interact with the broker, potentially producing, consuming, or deleting messages a
Bugzilla
CVE-2024-32114 activemq-broker: Jolokia and REST API were not secured with default configuration
bugzilla·2024-05-03·CVSS 8.8
CVE-2024-32114 [HIGH] CVE-2024-32114 activemq-broker: Jolokia and REST API were not secured with default configuration
CVE-2024-32114 activemq-broker: Jolokia and REST API were not secured with default configuration
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt
https://issues.apache.org/jira/browse/AMQ-9477
Hackernews
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
blogs_hackernews·2026-04-23
CVE-2026-27175 ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.
The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work, giving attackers easy access.
AI tools are also part of the problem now. They trust bad input and take real actions, which makes the damage
Hackernews
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
blogs_hackernews·2026-04-17·CVSS 8.8
CVE-2026-34197 [HIGH] Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 (CVSS score: 8.8), to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by April 30, 2026.
CVE-2026-34197 has been described as a case of improper input validation that could lead to code injection, eff
Hackernews
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
blogs_hackernews·2026-04-09
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
Thursday. Another week, another batch of things that probably should've been caught sooner but weren't.
This one's got some range — old vulnerabilities getting new life, a few "why was that even possible" moments, attackers leaning on platforms and tools you'd normally trust without thinking twice. Quiet escalations more than loud zero-days, but the kind that matter more in practice anyway.
Mix of malware, infrastructure exposure, AI-adjacent weirdness, and some supply chain stuff that's... not great. Let's get into it.
A new variant of the
Bleepingcomputer
13-year-old bug in ActiveMQ lets hackers remotely execute commands
blogs_bleepingcomputer·2026-04-08·CVSS 8.5
CVE-2026-34197 [HIGH] 13-year-old bug in ActiveMQ lets hackers remotely execute commands
## 13-year-old bug in ActiveMQ lets hackers remotely execute commands
## Bill Toulas
This is also the reason why it was missed for more than a decade.
Apache ActiveMQ is an open-source message broker written in Java that handles asynchronous communication via message queues or topics.
Although ActiveMQ has released a newer ‘Artemis’ branch with better performance, the ‘Classic’ edition impacted by CVE-2026-34197 is widely deployed in enterprise, web backends, government, and company systems built on Java.
Horizon3 researcher Naveen Sunkavally found the issue "with nothing more than a couple of basic prompts" in Claude. "This was 80% Claude with 20% gift-wrapping by a human," he said.
Sunkavally notes that Claude pointed to the issue after examining multiple individual components (Jol
Wiz
CVE-2026-34197 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34197 :
Apache ActiveMQ Classic vulnerability analysis and mitigation
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext insta
2024-05-02
Published
Exploited in the wild