Apache ActiveMQ Broker exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ with a default access policy permitting exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can exploit this by providing a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, this leads to arbitrary code execution on the broker's JVM through bean factory methods such as Runtime.exec(). This vulnerability affects Apache ActiveMQ Broker versions before 5.19.4 and from 6.0.0 before 6.2.3. The issue is fixed in versions 5.19.4 and 6.2.3.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the JVM running the Apache ActiveMQ Broker. This can lead to full compromise of the broker service, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector, low attack complexity, and no user interaction required.

A fix is available. Users are strongly advised to upgrade Apache ActiveMQ Broker to version 5.19.4 or 6.2.3, which address this vulnerability. No alternative mitigations or temporary fixes are documented in the vendor advisory. Patch status is confirmed by the vendor advisory. There is no indication that this is a cloud service; therefore, manual upgrade is required.