CISA Adds 13-Year-Old Apache ActiveMQ RCE to KEV Catalog, Giving Federal Agencies Two Weeks to Patch a Bug Found by Claude in Ten Minutes

Overview

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ Classic, to its Known Exploited Vulnerabilities catalog on April 16, 2026, according to CISA’s alert. The addition triggers Binding Operational Directive 22-01, giving Federal Civilian Executive Branch agencies until April 30 to patch affected systems. The bug had been sitting in the open-source message broker’s codebase for roughly 13 years before a security researcher surfaced it with the help of a large language model.

What We Know

The flaw is rated CVSS 8.8 and allows an authenticated user to execute arbitrary code on the broker’s JVM by abusing the Jolokia management API, BleepingComputer reported. Apache patched the issue on March 30 with ActiveMQ Classic 5.19.4 and 6.2.3, eight days after Horizon3.ai disclosed it to the project on March 22, BleepingComputer’s earlier coverage noted.

The exploit chains several individually benign features. An attacker invokes the addNetworkConnector operation on the broker MBean through Jolokia, supplies a crafted vm:// discovery URI whose brokerConfig parameter points to a remote Spring XML document, and relies on Spring’s ResourceXmlApplicationContext instantiating beans before ActiveMQ validates the configuration, per CSO Online’s technical summary. A MethodInvokingFactoryBean in the malicious XML can then call Runtime.getRuntime().exec() to run arbitrary commands on the host.

The discovery itself has become part of the story. Horizon3.ai chief architect Naveen Sunkavally said Anthropic’s Claude produced the full attack path from the ActiveMQ source tree with minimal prompting, CSO Online reported: “Something that would have probably taken me a week manually took Claude 10 minutes.” He characterized the research as “80% Claude with 20% gift-wrapping by a human” and said he now routinely asks the model to take a first pass at source code when hunting for bugs, Infosecurity Magazine reported.

Many deployments remain exposed. The Register reported that ShadowServer is tracking more than 8,000 publicly reachable ActiveMQ instances and that “many deployments still rely on default credentials – the ever-reliable ‘admin:admin,’” which makes the authenticated requirement trivial to satisfy. The same report notes that on versions 6.0.0 through 6.1.1 an older flaw, CVE-2024-32114, can expose the Jolokia API without authentication, collapsing the chain into an unauthenticated remote code execution path.

Exploitation Activity

CISA’s addition to the KEV catalog formally signals that CVE-2026-34197 is being used in real-world attacks, though neither the agency nor the vendors involved have publicly attributed the activity to a specific threat actor. The KEV entry itself does not disclose volumes, dates, or campaign details, and the BleepingComputer and Register reports covering the listing do not attach specific telemetry to the exploitation claim.

Apache ActiveMQ has a history of post-disclosure mass exploitation. CVE-2023-46604, another RCE in the broker, was weaponized by multiple ransomware crews within weeks of its 2023 disclosure. The Machine Herald has previously reported on the broader pattern of AI companies pledging to shield open-source maintainers from the wave of AI-generated security reports their own tools have helped produce, and on how AI-generated slop is overwhelming open-source projects. CVE-2026-34197 sits at the opposite end of that spectrum — an AI-assisted finding that resulted in a coordinated disclosure, a patch, and, now, federal mandatory remediation.

What We Don’t Know

Neither CISA nor the researchers have disclosed when exploitation of CVE-2026-34197 began, or whether the attacks are opportunistic scans, targeted intrusions, or early-stage ransomware staging. The identity of the threat actors is also unknown. CISA’s April 16 alert restates the standard KEV language without naming specific campaigns. It is likewise unclear how many of the 8,000-plus exposed instances tracked by ShadowServer are running the vulnerable 6.0.0–6.1.1 range where the CVE-2024-32114 chain makes authentication optional.

Remediation

CISA’s guidance directs organizations to apply the vendor patches — ActiveMQ Classic 5.19.4 or 6.2.3 — follow BOD 22-01 guidance for cloud services, or discontinue use if patches cannot be applied. Operators can look for indicators of compromise in broker logs, including POST requests to /api/jolokia/ endpoints with addNetworkConnector in the request body, network connector activity referencing vm:// URIs with brokerConfig=xbean:http, unexpected outbound HTTP requests from the ActiveMQ broker process, and unexpected child processes spawned by the ActiveMQ Java process, per Infosecurity Magazine’s write-up. Federal agencies have until April 30, 2026 to remediate; CISA strongly encourages private-sector operators to meet the same deadline.