Apache ActiveMQ Broker exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ with a default access policy permitting exec operations on all ActiveMQ MBeans, including BrokerService methods that add connectors. An authenticated attacker can craft a discovery URI that causes the VM transport's brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext. Because Spring instantiates all singleton beans before BrokerService validates the configuration, this leads to arbitrary code execution on the JVM through bean factory methods such as Runtime.exec(). This vulnerability affects Apache ActiveMQ Broker versions prior to 5.19.5 and 6.2.3. Users are advised to upgrade to these fixed versions.

An authenticated attacker can achieve arbitrary code execution on the Apache ActiveMQ Broker JVM by exploiting improper input validation in the Jolokia JMX-HTTP bridge. This can lead to full compromise of the broker process, potentially allowing control over messaging infrastructure and execution of malicious code within the broker environment.

Users should upgrade Apache ActiveMQ Broker to version 5.19.5 or 6.2.3, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the advisory. Patch status is confirmed by the vendor's recommendation to upgrade to these versions.