CVE-2026-40466: 
Java vulnerability analysis and mitigation

CVE-2026-40466 is an Improper Input Validation and Code Injection vulnerability (CWE-20, CWE-94) in Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ that allows authenticated attackers to achieve arbitrary code execution on the broker's JVM. It affects all versions before 5.19.6 and versions 6.0.0 through 6.2.4. The vulnerability is a bypass of the previously issued fix for CVE-2026-34197, disclosed and published on April 24, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is insufficient validation of HTTP Discovery transport URIs when adding connectors via the Jolokia JMX-HTTP bridge. An authenticated attacker can call BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia with a crafted HTTP Discovery URI; a malicious HTTP endpoint then returns a VM transport, bypassing the input validation introduced in CVE-2026-34197. The attacker leverages the VM transport's brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext, which instantiates all singleton beans before BrokerService validates the configuration — enabling arbitrary code execution through bean factory methods such as Runtime.exec(). This attack path is only possible when the activemq-http module is present on the classpath (GitHub Advisory, Apache Advisory).

Successful exploitation grants an authenticated attacker full arbitrary code execution on the ActiveMQ broker's JVM, resulting in high confidentiality, integrity, and availability impact. An attacker can execute arbitrary OS commands, exfiltrate sensitive data processed by the message broker, disrupt broker availability, and potentially pivot laterally to downstream systems that depend on the ActiveMQ infrastructure. Because message brokers often serve as central integration hubs, compromise can cascade across connected applications and services (GitHub Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation (Feedly). The EPSS score from the GitHub Advisory Database is approximately 18%, indicating a meaningful probability of exploitation within 30 days (GitHub Advisory). The vulnerability requires low-privilege authentication, making it accessible to any user with broker credentials. Nuclei detection templates have been developed and merged into the ProjectDiscovery nuclei-templates repository, and Emerging Threats released network detection rules (ruleset update v11190, May 11, 2026), indicating active community interest in detection (Feedly). The CVE is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify Apache ActiveMQ instances running vulnerable versions (before 5.19.6 or 6.0.0–6.2.4) with the activemq-http module on the classpath and the Jolokia endpoint exposed at /api/jolokia/.
2. Authenticate: Obtain valid broker credentials (low-privilege user account is sufficient) through credential stuffing, phishing, or other means.
3. Set up malicious HTTP server: Host a crafted HTTP endpoint that, when queried as a Discovery transport URI, returns a VM transport URL containing a brokerConfig parameter pointing to an attacker-controlled Spring XML application context file.
4. Craft malicious Spring XML context: Prepare a remote Spring XML file defining a singleton bean that invokes Runtime.exec() or another code execution method (e.g., a reverse shell command) within its factory or init method.
5. Invoke Jolokia operation: Send an authenticated HTTP request to the Jolokia endpoint invoking BrokerView.addNetworkConnector or BrokerView.addConnector with the crafted HTTP Discovery URI pointing to the malicious HTTP server.
6. Trigger bypass: The ActiveMQ broker fetches the HTTP Discovery URI; the malicious server returns a VM transport URL, bypassing CVE-2026-34197 validation.
7. Achieve code execution: The broker loads the remote Spring XML context via ResourceXmlApplicationContext; Spring instantiates the malicious singleton bean before configuration validation, executing arbitrary code on the broker's JVM (GitHub Advisory, Apache Advisory).

• Network: Outbound HTTP requests from the ActiveMQ broker process to unexpected external hosts (attacker-controlled Spring XML context server); unusual DNS lookups from the broker host to unknown domains; outbound connections on non-standard ports from the broker JVM (e.g., reverse shell traffic).
• Logs: ActiveMQ web console or Jolokia access logs showing authenticated POST requests to /api/jolokia/exec/org.apache.activemq:* invoking addNetworkConnector or addConnector with HTTP Discovery URIs; Spring ResourceXmlApplicationContext initialization log entries referencing remote URLs.
• Process: Unexpected child processes spawned by the ActiveMQ JVM process (e.g., bash, sh, cmd.exe, curl, wget, python, powershell); unusual process trees originating from the Java broker process.
• File System: New or modified files in the ActiveMQ installation directory or temp directories created by the broker process; web shells or scripts dropped by the broker service account; unexpected cron jobs or scheduled tasks created under the broker's OS user.
• Network Signatures: Emerging Threats ruleset v11190 (released May 11, 2026) includes network detection rules for this CVE (Emerging Threats).

Upgrade Apache ActiveMQ to version 5.19.6 or 6.2.5, which contain the fix for this vulnerability (GitHub Advisory). If immediate upgrade is not possible, apply the following mitigations: (1) Remove or exclude the activemq-http module from the classpath to eliminate the HTTP Discovery transport attack path; (2) Restrict Jolokia access to trusted administrators only, or disable the Jolokia endpoint entirely if not required; (3) Implement network segmentation to limit access to the ActiveMQ web console and Jolokia interface; (4) Apply strict authentication controls and rotate broker credentials. Monitor broker logs for suspicious connector additions via Jolokia as a compensating control (Feedly).

The vulnerability was discussed on the OSS-Security mailing list shortly after disclosure and received attention from the security community on social platforms including Bluesky and Mastodon (seclists.org). Sangfor's Farsight Labs published a threat intelligence write-up on the vulnerability, and SecureReading covered it as part of a broader advisory on multiple Apache ActiveMQ vulnerabilities enabling RCE (Sangfor, SecureReading). The CVE appeared in the Reddit CVEWatch community's top trending CVEs for the week of June 9, 2026, indicating sustained community interest. ProjectDiscovery added a Nuclei detection template for this CVE in their April 2026 release (ProjectDiscovery Blog).