Jolokia JMX Bridge Enables Authenticated Code Injection in ActiveMQ

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 befor

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at the /api/jolokia/ endpoint on its web console, which by default permits exec operations on all ActiveMQ MBeans. This vulnerability combines improper input validation (CWE-20) with code injection capabilities (CWE-94), allowing authenticated attackers to invoke arbitrary operations like BrokerService.addNetworkConnector() through crafted discovery payloads. Organizations running ActiveMQ web consoles are at risk, particularly those exposing the console to untrusted networks or with weak authentication controls. The high CVSS score of 8.1 reflects the severity of allowing authenticated remote code execution on critical message broker infrastructure.

Casky's 301 mapped skills leverage Claude AI's extended reasoning to detect exploitation patterns across MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) techniques. Practitioners would observe Casky identifying suspicious HTTP requests to /api/jolokia/ endpoints containing serialized objects or method invocation attempts, anomalous MBean operation calls targeting BrokerService with network connector parameters, and post-exploitation indicators such as unexpected network connections initiated by the ActiveMQ process. The platform's skill correlation would flag the progression from discovery scanning through credential use to code execution, enabling security teams to distinguish legitimate administrative access from attack chains attempting to establish persistence or lateral movement through broker manipulation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-42588.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-42588

Casky has 301 skills that investigate the attack patterns behind CVE-2026-42588. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn