Apache ActiveMQ Broker versions prior to 5.19.4 and from 6.0.0 before 6.2.3 have an improper input validation vulnerability (CWE-20) that allows authenticated attackers to perform code injection (CWE-94) via the Jolokia JMX-HTTP bridge. The default Jolokia policy permits exec operations on all ActiveMQ MBeans, including BrokerService methods that accept discovery URIs. Crafted URIs can trigger the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Since Spring instantiates singleton beans before BrokerService validates the configuration, this leads to arbitrary code execution on the JVM through bean factory methods such as Runtime.exec(). The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated attacker can exploit this vulnerability to execute arbitrary code on the Apache ActiveMQ Broker JVM, potentially leading to full compromise of the broker service. This can result in unauthorized control over message broker operations, data exposure, and disruption of messaging services. The high CVSS score (8.8) indicates severe impact on confidentiality, integrity, and availability.

A fix is available by upgrading Apache ActiveMQ Broker to version 5.19.4 or 6.2.3, which addresses this vulnerability. Users should apply these updates promptly. No vendor advisory was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the recommendation to upgrade to these fixed versions.