Apache ActiveMQ is facing renewed scrutiny after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-34197 to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies until no later than April 30, 2026, to patch under Binding Operational Directive 22-01. The flaw, which had reportedly existed unnoticed for thirteen (13) years, allows attackers to achieve remote code execution (RCE) through ActiveMQ’s exposed Jolokia management API by forcing the broker to load a malicious remote Spring XML configuration file. Although the vulnerability technically requires authentication, many environments still use default credentials such as “admin:admin,” making exploitation relatively easy. In certain ActiveMQ versions between 6.0.0 and 6.1.1, the flaw can even become fully unauthenticated when chained with CVE-2024-32114, which exposes the Jolokia API without login requirements. Security researchers noted that more than 8,000 internet-facing ActiveMQ instances remain exposed, increasing the likelihood of continued exploitation. Organizations are being urged to immediately upgrade to patched versions 5.19.5 or 6.2.3, restrict access to the Jolokia API and web console, eliminate default credentials, and closely monitor logs for suspicious broker configuration activity. CTIX analysts strongle urge any affected entities to ensure they patch their vulnerabilities and follow the mitigation instructions to prevent exploitation.