CVE-2026-34197: Apache ActiveMQ RCE — Detection and Remediation Guide

---
title: ActiveMQ Java Process Spawning Shell - CVE-2026-34197
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the ActiveMQ Java process spawning a shell, indicative of successful RCE exploitation attempts.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/16/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/04/16
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.34197
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains: 'activemq'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: Suspicious Network Connection to ActiveMQ Console
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects unusual POST requests to the ActiveMQ admin console port 8161, often associated with exploit attempts.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/16/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/04/16
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.34197
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 8161
    Protocol: tcp
  filter:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative access from internal networks
level: high

// Hunt for ActiveMQ parent process spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "java"
| where InitiatingProcessCommandLine has "activemq"
| where FileName in~ ("bash", "sh", "zsh", "powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

-- Hunt for ActiveMQ process spawning suspicious children
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Commandline AS ParentCmd
FROM pslist()
WHERE Parent.Name =~ "java"
  AND Parent.Cmdline =~ "activemq"
  AND Name IN ("sh", "bash", "zsh", "ksh", "powershell", "cmd")

#!/bin/bash
# ActiveMQ CVE-2026-34197 Emergency Response Script
# Usage: sudo ./check_activemq.sh

echo "[+] Checking for running ActiveMQ processes..."
ACTIVEMQ_PID=$(pgrep -f "activemq.jar")

if [ -z "$ACTIVEMQ_PID" ]; then
    echo "[-] ActiveMQ process not found."
else
    echo "[!] ActiveMQ found running with PID: $ACTIVEMQ_PID"
    echo "[+] Checking for spawned shells from ActiveMQ..."
    # Check children of the ActiveMQ Java process
    ps -o pid,ppid,cmd -p $(pgrep -P $ACTIVEMQ_PID) | grep -E "sh|bash|zsh"
    if [ $? -eq 0 ]; then
        echo "[CRITICAL] Potential exploit detected! ActiveMQ is spawning a shell."
        echo "[ Recommendation ] Kill the process and investigate immediately."
    else
        echo "[OK] No suspicious shell activity detected from ActiveMQ."
    fi
fi

echo "[+] Verifying Firewall Rules for Port 61616 and 8161..."
if command -v iptables &> /dev/null; then
    iptables -L INPUT -v -n | grep -E "61616|8161"
    echo "[ Recommendation ] Ensure these ports are restricted to known management subnets ONLY."
else
    echo "[-] iptables not found to check rules."
fi

echo "[+] Checking ActiveMQ Version..."
# Adjust path as necessary (e.g., /opt/activemq)
ACTIVEMQ_HOME=$(dirname $(dirname $(readlink -f $(which java 2>/dev/null || echo "/usr/lib/jvm"))) 2>/dev/null)
# Heuristic check for version in lib or startup scripts
find /opt /usr/local -name "activemq.jar" -exec ls -lh {} \; 2>/dev/null

echo "[+] Action Required:"
echo "1. Apply patches for CVE-2026-34197 immediately from Apache."
echo "2. Restrict network access to ports 61616 (OpenWire) and 8161 (Web Console)."