An authenticated attacker with access to the broker’s admin web console can craft a broker name that contains a malicious xbean binding. When the DestinationView MBean is later used to send a message, this binding triggers the creation of a VM transport that loads the attacker’s Spring XML context file. Because Spring’s ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, the broker’s JVM executes code supplied by the attacker, typically via a Runtime.exec() call. The result is arbitrary code execution on the broker’s host machine.

Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All products from versions prior to 5.19.6 and from 6.0.0 through 6.2.4 are vulnerable. Versions 6.2.5 and 5.19.6, and later releases, contain the fix.

The CVSS score of 8.8 indicates a high overall severity, while the EPSS score of less than 1% suggests that the exploit is currently unlikely to be widely used. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session to the broker’s admin console and the ability to create or modify broker names, making it a privilege-based risk. Once a privileged user supplies a malicious broker name, the broker can execute arbitrary code in the context of the broker process, potentially granting the attacker full control over the underlying operating system.