Apache ActiveMQ Jolokia Flaws Enable Zero-Credential Remote Code Execution

Active exploitation has been observed against an Apache ActiveMQ remote code execution chain involving the Jolokia management API. VulnCheck reported canary-network hits tied to CVE-2026-34197, which was added to CISA's Known Exploited Vulnerabilities catalog, and said attackers are also using an unauthenticated variant that chains CVE-2024-32114 with CVE-2026-34197 to achieve zero-credential RCE. According to the reporting, CVE-2024-32114 removes authentication from the Jolokia endpoint in ActiveMQ versions 6.0.0 through 6.1.1, exposing the management interface to unauthenticated abuse.

Technical details published by Horizon3.ai describe the RCE path through the Jolokia API, while VulnCheck said observed payloads invoked addNetworkConnector through Jolokia during exploitation. One captured payload referenced a private IP address, indicating the attacker activity may have reused a lab or proof-of-concept configuration, but the exploitation itself was confirmed in the wild. The combined reporting indicates that exposed ActiveMQ instances with vulnerable Jolokia configurations face immediate risk of unauthenticated remote compromise.