Apache ActiveMQ Broker versions prior to 5.19.7 and from 6.0.0 before 6.2.6 expose a Jolokia JMX-HTTP bridge with a default policy permitting exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String). An authenticated attacker can supply a crafted discovery URI using the "masterslave://" URL scheme that triggers the brokerConfig parameter to load a Spring XML application context via ResourceXmlApplicationContext. Because Spring instantiates all singleton beans before BrokerService validates the configuration, this allows arbitrary code execution on the JVM through bean factory methods such as Runtime.exec(). This improper input validation and control of code generation vulnerability is tracked as CWE-20 and CWE-94.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the broker's JVM, potentially leading to full compromise of the ActiveMQ Broker process. This could enable unauthorized actions within the messaging infrastructure, impacting confidentiality, integrity, and availability of messaging services.

Users should upgrade Apache ActiveMQ Broker to version 5.19.7 or 6.2.6, which contain fixes for this vulnerability. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the recommendation to upgrade; therefore, verify with the vendor advisory for the latest remediation guidance.