An authenticated adversary can bypass the protection introduced in CVE-2026-34197 by adding a connector with an HTTP Discovery transport through the BrokerView interfaces exposed via Jolokia, provided the activemq-http module is present in the application classpath. The crafted HTTP endpoint returns a VM transport URI that allows the attacker to inject a brokerConfig that loads an external Spring XML application context via ResourceXmlApplicationContext. Because the Spring context is instantiated before the broker service performs configuration validation, the attacker can trigger bean factory methods such as Runtime.exec(), leading to arbitrary code execution on the broker’s JVM. This flaw maps to input validation (CWE‑20) and code injection (CWE‑94) weaknesses.

Affected products are Apache Software Foundation’s ActiveMQ Broker, ActiveMQ All and ActiveMQ core. In addition to all releases prior to 5.19.6, any 6.0.0–6.2.4 series is vulnerable. The advisory explicitly recommends upgrading to 5.19.6 or any 6.2.5 and later release to eliminate the code execution vector.

The vulnerability has a CVSS score of 8.8, denoting high severity, but the EPSS score of 10% indicates a higher likelihood of exploitation. It is currently not listed in the CISA KEV catalog. The effect is remote code execution that would be achieved by an attacker who can authenticate with the broker and has network access to the Jolokia endpoint and can place an activemq-http JAR on the broker’s classpath. In the absence of an update, the risk remains elevated, especially for exposed brokers that expose Jolokia or other JMX endpoints to untrusted networks.