CISA flags Apache ActiveMQ flaw as actively exploited in attacks

Apache ActiveMQ suffers a high-severity RCE vulnerability (CVE-2026-34197) — present for 13 years — that was patched in ActiveMQ Classic 6.2.3 and 5.19.4; CISA reports active exploitation, added the CVE to its KEV catalog, and ordered federal agencies to patch within two weeks. ShadowServer reports over 7,500 exposed ActiveMQ servers, Horizon3 provided detection guidance (suspicious brokerConfig=xbean:http:// connections and VM transport usage), and organizations are urged to prioritize mitigation or discontinuation if mitigations are unavailable.