This vulnerability involves improper input validation and control of code generation in Apache ActiveMQ Broker. An authenticated attacker can bypass the fix from CVE-2026-34197 by adding a network connector via Jolokia with the activemq-http module on the classpath. The attacker can exploit a malicious HTTP endpoint that returns a VM transport URI, which bypasses validation and allows loading of a remote Spring XML application context. Because Spring's ResourceXmlApplicationContext instantiates singleton beans before BrokerService validates configuration, arbitrary code execution occurs on the broker JVM through bean factory methods such as Runtime.exec(). The vulnerability affects Apache ActiveMQ Broker versions before 5.19.6 and from 6.0.0 before 6.2.5. The issue is resolved in versions 5.19.6 and 6.2.5.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the broker's JVM, potentially leading to full compromise of the ActiveMQ Broker process. This can undermine the integrity and availability of the messaging service and may allow further attacks within the environment. No known exploits in the wild have been reported at this time.

Users should upgrade Apache ActiveMQ Broker to version 5.19.6 or 6.2.5, where this vulnerability is fixed. No other official remediation or temporary workaround is indicated. Patch status is not explicitly stated in the vendor advisory, but the description clearly recommends upgrading to these fixed versions.