CVE-2026-45505: Apache ActiveMQ Code Injection Vulnerability—Exploit & Patch Guidance

Technical summary

CVE-2026-45505 is a code injection vulnerability in Apache ActiveMQ's Jolokia bridge. The vulnerability chains improper input validation (CWE-20) with unsafe code generation (CWE-94). Unauthenticated access to Jolokia is restricted, but authenticated users can invoke BrokerService.addNetworkConnector() or BrokerService.addConnector() with crafted discovery URLs that bypass validation. When the VM transport processes these URLs with the brokerConfig parameter, Spring's ResourceXmlApplicationContext loads remote XML files and instantiates all singleton beans before broker-side validation occurs. Malicious beans leverage Spring factory methods—such as those invoking Runtime.exec()—to achieve arbitrary code execution in the broker JVM. The vulnerability affects ActiveMQ versions before 5.19.7 and 6.0.0–6.2.5.

Business impact

Exploitation grants attackers the ability to run arbitrary code with the privileges of the ActiveMQ broker process. In many deployments, this translates to lateral movement opportunities, data exfiltration, message tampering, denial of service, or pivot points into backend systems. The attack requires prior authentication, reducing opportunistic exploitation but elevating insider threat risk and the impact of credential compromise. Organizations relying on ActiveMQ for critical messaging infrastructure face potential disruption and data integrity loss.

Affected systems

Apache ActiveMQ Broker versions before 5.19.7 and from 6.0.0 before 6.2.6 are vulnerable. The advisory covers Apache ActiveMQ Broker, Apache ActiveMQ All, and the base Apache ActiveMQ product line across these version ranges. Users on 5.19.7, 6.2.6, or later are protected.

Exploitability

Exploitation requires valid broker credentials (Jolokia authentication). The attack is network-accessible with low attack complexity—no special tooling or user interaction is needed beyond crafting a malicious discovery URL. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network access, low complexity, and high impact across confidentiality, integrity, and availability. However, the authentication requirement moderates the practical risk in hardened environments with strong credential controls.

Remediation

Upgrade immediately to Apache ActiveMQ 5.19.7 or 6.2.6 or later. These versions fix the validation bypass by properly rejecting non-parenthesized discovery wrapper formats. If immediate patching is not feasible, restrict Jolokia access through network segmentation, firewall rules, or reverse proxy configurations to limit exposure to trusted administrative networks only.

Patch guidance

Apache ActiveMQ 5.19.7 and 6.2.6 contain the fixes. Apply these versions or any later release. Verify the patch against the official Apache ActiveMQ security advisory to ensure your build includes the discovery wrapper validation improvements. Test in a staging environment before production deployment to confirm compatibility with custom configurations and dependent applications.

Detection guidance

Monitor for HTTP POST requests to `/api/jolokia/` endpoints containing discovery wrapper patterns such as `masterslave:vm://` or `static:vm://` in the request body. Log and alert on invocations of BrokerService.addNetworkConnector() or BrokerService.addConnector() operations via Jolokia. Examine broker logs for Spring context loading errors or unexpected bean instantiation. Network detection should flag outbound connections from ActiveMQ brokers to external XML resources. Review Jolokia access logs for anomalous authenticated user activity, especially from service accounts or during off-hours.

Why prioritize this

HIGH priority due to the 8.8 CVSS score, code execution capability, and the ease of exploitation once credentials are obtained. Organizations should prioritize patching in the sequence: production messaging brokers handling sensitive data, development environments with shared credentials, and lower-risk test systems. The authentication requirement provides a partial natural barrier, but compromised credentials or insider threats elevate urgency.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible attack (AV:N) with low complexity (AC:L), requiring authentication (PR:L), no user interaction (UI:N), single system scope (S:U), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). While the authentication requirement prevents unauthenticated exploitation, the severity remains high because valid credentials can be obtained through phishing, insider access, or previous compromises. The impact is not limited to information disclosure; attackers gain full code execution.

Frequently asked questions