CVE-2026-34197: Apache ActiveMQ Remote Code Execution — Detection and Hardening Guide

---
title: ActiveMQ Java Process Spawning Shell - Potential CVE-2026-34197 Exploitation
id: 9e4b8d2c-5a6f-4c7b-9e1d-3f5a6b7c8d9e
status: experimental
description: Detects the Apache ActiveMQ Java process spawning cmd.exe, powershell.exe, or sh, indicative of successful RCE.
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.execution
  - attack.t1059.001
  - cve.2026.34197
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\java.exe'
    ParentCommandLine|contains: 'activemq'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative debugging by vendor
level: critical
---
title: ActiveMQ Outbound Connection to Non-Standard Port
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects ActiveMQ Java process initiating outbound connections to suspicious ports, potentially C2 beaconing.
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.command_and_control
  - attack.t1071
  - cve.2026.34197
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    InitiatingProcessImage|endswith: '\java.exe'
    InitiatingProcessCommandLine|contains: 'activemq'
    DestinationPort|not:
      - 61616
      - 61613
      - 8161
      - 5672
      - 1883
  condition: selection
falsepositives:
  - Legitimate plugin connectivity to external databases or APIs
level: high

// Hunt for ActiveMQ parent process spawning suspicious children
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "java.exe"
| where InitiatingProcessCommandLine contains "activemq"
| where ProcessFileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| extend FullContext = strcat('Parent: ', InitiatingProcessCommandLine, ' Child: ', ProcessCommandLine)

-- Hunt for Java processes (ActiveMQ) with unexpected children
SELECT
  Parent.Name AS ParentName,
  Parent.Cmdline AS ParentCmd,
  Child.Name AS ChildName,
  Child.Cmdline AS ChildCmd,
  Child.Pid
FROM pslist()
LEFT JOIN pslist() AS Child ON Child.Ppid = Parent.Pid
WHERE Parent.Name =~ "java"
  AND Parent.Cmdline =~ "activemq"
  AND Child.Name =~ "(cmd|powershell|pwsh|bash|sh|curl|wget)"

#!/bin/bash
# ActiveMQ CVE-2026-34197 Emergency Hardening Script
# Version 1.0

ACTIVE_MQ_USER="activemq"\ACTIVE_MQ_HOME="/opt/activemq" # Adjust path as needed
PATCHED_VERSION="5.18.4"

echo "[*] Checking Apache ActiveMQ version..."

if [ -f "$ACTIVE_MQ_HOME/bin/activemq" ]; then
    CURRENT_VERSION=$($ACTIVE_MQ_HOME/bin/activemq --version 2>&1 | grep -oP 'ActiveMQ \K[0-9.]+')
    echo "[!] Detected Version: $CURRENT_VERSION"

    # Simple string comparison for version (assume 5.x versions)
    if [ "$CURRENT_VERSION" \< "$PATCHED_VERSION" ]; then
        echo "[!!] CRITICAL: Vulnerable version detected."
        echo "[*] Applying interim mitigation: Restricting OpenWire port to localhost..."
        
        # Backup config
        cp $ACTIVE_MQ_HOME/conf/activemq.xml $ACTIVE_MQ_HOME/conf/activemq.xml.bak
        
        # Note: This sed command is a basic example. Actual XML manipulation requires care or a proper config management tool.
        # This attempts to bind the transportConnector to 127.0.0.1 if it isn't already.
        # Verify changes in /opt/activemq/conf/activemq.xml after running.
        
        echo "[+] Config backup created."
        echo "[!!!] MANUAL ACTION REQUIRED: Please edit $ACTIVE_MQ_HOME/conf/activemq.xml immediately."
        echo "      Ensure the 'transportConnector' URI uses '127.0.0.1' instead of '0.0.0.0' or hostnames."
        echo "      Restart service after edit: systemctl restart activemq"
    else
        echo "[+] Version appears patched or safe."
    fi
else
    echo "[-] ActiveMQ installation not found at default path."
fi