CVE-2026-42588 is a vulnerability in Apache ActiveMQ Broker caused by improper input validation (CWE-20) in the Jolokia JMX-HTTP bridge. This allows authenticated users to perform exec operations on all ActiveMQ MBeans, including the BrokerService.addNetworkConnector method. By crafting a discovery URI with a specific brokerConfig parameter, an attacker can cause the broker to load a malicious Spring XML application context. This leads to arbitrary code execution on the broker's JVM through bean factory methods such as Runtime.exec(). The vulnerability affects Apache ActiveMQ Broker versions prior to 5.19.7 and version 6.0.0. The CVSS v3.1 base score is 8.1 (High), with network attack vector, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality and integrity but no impact on availability. No official fix or patch has been confirmed as of the published date.

An authenticated attacker can execute arbitrary code on the Apache ActiveMQ Broker's JVM, potentially compromising the broker's confidentiality and integrity. This could allow the attacker to run malicious commands or code within the broker environment. The vulnerability does not impact availability directly but poses a significant risk due to code execution capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Jolokia JMX-HTTP bridge to trusted users only and monitor for suspicious activity. Avoid exposing the broker's management interfaces to untrusted networks. Follow any additional guidance from Apache Software Foundation advisories once published.