This vulnerability arises from improper input validation in Apache ActiveMQ Broker's handling of LDAP entries that match configured searchBase and searchFilter parameters. An attacker who can publish or modify these LDAP entries can cause the broker JVM to instantiate denied transports, enabling the broker to fetch attacker-controlled URLs and spawn an additional BrokerService instance within the same JVM. This behavior could lead to unauthorized code execution or service manipulation within the broker environment. The vulnerability affects Apache ActiveMQ Broker versions prior to 5.19.8 and versions from 6.0.0 before 6.2.7. The recommended remediation is to upgrade to Apache ActiveMQ Broker versions 5.19.8 or 6.2.7 and later, which contain fixes for this issue.

An attacker with the capability to publish or modify LDAP entries matching the broker's configured searchBase and searchFilter can exploit this vulnerability to instantiate unauthorized transports inside the broker JVM. This may allow the attacker to fetch malicious URLs and spawn a second BrokerService instance within the same JVM, potentially leading to unauthorized code execution or disruption of broker operations.

Users should upgrade Apache ActiveMQ Broker to version 5.19.8 or 6.2.7 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor advisory recommending these versions.