CVE-2026-42588: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

Synopsis

This is a code injection vulnerability in Apache ActiveMQ Classic. The attack is reachable over the network and requires a low-privilege authenticated account; no other interaction is needed. A successful attacker can execute arbitrary code on the broker's JVM, and read or modify application data. Patched-image rebuilds at versions 5.19.7 and 6.2.6 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Jolokia endpoint is exposed over HTTP on the ActiveMQ web console, so the attacker must be able to reach the service across the network.

• AuthenticationRequired

  Any low-privilege account with access to the ActiveMQ web console is sufficient; no administrative credentials are required.

• Victim interactionNot required

  The attacker sends crafted requests directly to the Jolokia endpoint and no user action or social engineering is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free: invoking the addNetworkConnector MBean with a crafted URI consistently triggers Spring context loading and code execution without requiring race conditions or special memory layout.

Blast Radius

• The attacker executes arbitrary operating-system commands on the broker's JVM host via Spring bean factory methods such as Runtime.exec().
• Confidential data accessible to the ActiveMQ process, including messages, credentials, and configuration files, can be read and exfiltrated.
• Persisted data reachable by the broker, such as queued messages and destination configurations, can be modified or deleted.