Apache ActiveMQ Classic includes a Jolokia JMX‑HTTP bridge at /api/jolokia/ that by default permits exec operations on all ActiveMQ MBeans. An authenticated attacker can craft a request to trigger the VM transport’s brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext. Because Spring instantiates all singleton beans before broker configuration validation, the broker JVM can execute arbitrary code through bean factory methods such as Runtime.exec(). This is a classic code injection flaw that falls under Improper Input Validation (CWE‑20), Improper Control of Generation of Code (CWE‑94), and System Interface Use with Untrusted Input (CWE‑78). The effect is remote code execution on the broker’s JVM.

The flaw affects Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ Classic. Versions earlier than 5.19.4 and all releases from 6.0.0 up to but not including 6.2.3 are affected. All of these products expose the vulnerable Jolokia interface and therefore allow the described exploitation path.

The vulnerability scores 8.8 on CVSS, indicating high severity. The EPSS score is 63 %, indicating a high probability of exploitation in the wild, and it is listed in the CISA KEV catalog, indicating that the vulnerability is known to be exploited in the field. Nevertheless, because it enables remote code execution once an attacker has broker credentials, the risk remains significant. Exploitation requires network access to the broker, valid authentication, and the ability to send the crafted request, after which arbitrary code runs with the broker process’s privileges.