RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years
Source SecurityWeek
Rated Critical by Threat Radar from the SecurityWeek text
Data as of 8 Apr 2026, 14:35 UTC
What to do
AI-suggested
Until an official fix is available, restrict access to the Jolokia API and ensure that authentication mechanisms are properly enforced to mitigate potential exploitation.
Description
A remote code execution (RCE) vulnerability has been discovered in Apache ActiveMQ Classic that remained undetected for 13 years. Exploitation of this vulnerability requires authentication; however, a separate flaw allows unauthenticated access to the Jolokia API, potentially enabling attackers to bypass this requirement. No patch or official remediation information is provided at this time. The severity is assessed as medium based on the available information.