ACTIVELY EXPLOITED
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
| Vendor | Apache |
|---|---|
| Product | ActiveMQ |
| Actively exploited | Yes |
| Added to CISA KEV | 16 Apr 2026 |
| CISA federal deadline | 30 Apr 2026 |
| Weakness (CWE) | CWE-20, CWE-94 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
SOURCES
Other Apache flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
- CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.