This vulnerability permits an authenticated attacker to execute arbitrary code on the broker’s JVM by passing a specially crafted discovery URI to the Jolokia JMX‑HTTP bridge. It stems from insufficient validation of the discovery wrapper and a code‑injection path through Spring’s ResourceXmlApplicationContext, allowing bean factory methods such as Runtime.exec() to run on the broker process.

Affected products include Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Broker. Versions before 5.19.7 and those from 6.0.0 through 6.2.5 are vulnerable; upgrades to 5.19.7 or 6.2.6 resolve the issue.

Exploitation requires authenticated access to the Jolokia endpoint; an attacker can invoke BrokerService.addNetworkConnector or addConnector with a crafted URI that triggers remote XML context loading. The CVSS score is not listed, but the absence of an EPSS value suggests exploits are not yet widespread. Nonetheless, the capability for remote code execution places the vulnerability in the high‑severity domain, and it is not currently catalogued in CISA’s KEV list.