CISA Warns of Apache ActiveMQ Input Validation Vulnerability Exploited in Attacks

CISA warns of a critical Apache ActiveMQ vulnerability (CVE-2026-34197) that allows unauthenticated code injection and remote code execution; the flaw is being actively exploited and was added to the KEV catalog. Federal agencies are required to remediate by April 30, 2026 under BOD 22-01, and organizations are urged to apply vendor patches, disconnect vulnerable instances if necessary, and monitor for indicators of injection or lateral movement.