ActiveMQ Code Injection via Unvalidated Discovery Wrappers

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197. Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache ActiveMQ contains an improper input validation vulnerability that allows attackers to bypass previous security fixes through non-parenthesized discovery wrapper syntax in broker URIs. By crafting malicious URIs like `masterslave:vm://...` or `static:vm://...`, attackers can inject arbitrary code that gets executed during broker initialization. This vulnerability affects all versions of Apache ActiveMQ and is particularly critical because it exploits a gap in validation logic that was meant to be patched by CVE-2026-34197. Organizations running ActiveMQ brokers—especially those exposed to untrusted network input or used in message-oriented middleware architectures—face immediate risk of remote code execution with high impact to confidentiality, integrity, and availability.

Casky's 301 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across two MITRE ATT&CK techniques: Initial Access (TA0001) and Resource Development (TA0043). Practitioners using Casky would identify findings related to malformed or unusual URI patterns in ActiveMQ configuration logs, unexpected code generation in broker initialization processes, and anomalous JMX/Jolokia bridge activity. The platform's skills enable detection of input bypassing validation checks, recognition of wrapper syntax variations designed to evade filtering, and identification of post-exploitation indicators such as unauthorized code execution or persistence mechanisms. By correlating these patterns with known attack chains, security teams can pinpoint vulnerable configurations before exploitation occurs and understand the complete threat chain from initial reconnaissance through code execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45505.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-45505

Casky has 301 skills that investigate the attack patterns behind CVE-2026-45505. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn