This vulnerability involves improper input validation and control of code generation in Apache ActiveMQ Broker. An authenticated attacker can bypass the fix from CVE-2026-34197 by adding a connector using an HTTP Discovery transport through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport via the HTTP URI, bypassing prior validation. The attacker can exploit the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Since Spring instantiates singleton beans before BrokerService validates the configuration, this leads to arbitrary code execution on the broker JVM via bean factory methods such as Runtime.exec(). The affected versions are Apache ActiveMQ Broker and Apache ActiveMQ All before 5.19.6, and from 6.0.0 before 6.2.5. The vulnerability has a CVSS 3.1 score of 8.8 (high severity).

Successful exploitation allows an authenticated attacker to execute arbitrary code on the broker's JVM, potentially compromising the system running Apache ActiveMQ Broker. This can lead to full control over the broker process and associated resources, impacting confidentiality, integrity, and availability.

A fix is available. Users should upgrade Apache ActiveMQ Broker to version 5.19.6 or 6.2.5 or later, which address this vulnerability. There is no indication from the vendor advisory that alternative mitigations or temporary fixes are available or recommended. Patch status is confirmed by the vendor advisory.