CVE-2026-34197
84.55%V4
2026-04-07
07h50 +00:00
07h50 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issueCVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
||
| Improper Control of Generation of Code The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
CISA KEV（已知被利用漏洞）
漏洞名稱 : Apache ActiveMQ Improper Input Validation Vulnerability
必要行動 : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
已知用於勒索軟體活動 : Unknown
新增日期 : 2026-04-16 00h00 +00:00
行動截止日期 : 2026-04-30 00h00 +00:00
重要資訊
根據已知被利用漏洞目錄（CISA KEV），此 CVE 已被識別為存在漏洞且構成主動威脅。CISA 已將此漏洞列為網路犯罪者正在積極利用的目標，強調立即採取行動修補此缺陷的重要性。必須優先更新和修復此 CVE，以保護系統免受潛在網路攻擊。
EPSS
EPSS 是一種預測漏洞被利用可能性的評分模型。
EPSS 評分
EPSS 模型產生介於 0 到 1（0% 到 100%）之間的概率分數。分數越高，漏洞被利用的概率越大。
EPSS 百分位數
百分位數用於根據 EPSS 分數對 CVE 進行排名。例如，EPSS 評分在第 95 百分位的 CVE 比 95% 的其他 CVE 更有可能被利用。因此，百分位數用於比較某 CVE 的 EPSS 分數與其他 CVE 的相對位置。
參考資料
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
Tags : vendor-advisory
Tags : vendor-advisory
