CVE-2026-34197: Apache ActiveMQ Unauthenticated RCE — Detection and Remediation Guide

---
title: Apache ActiveMQ Exploitation - Java Spawning Shell (Linux)
id: 8a4b3c2d-1e9f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects Apache ActiveMQ (Java process) spawning a shell on Linux, indicative of CVE-2026-34197 exploitation or similar RCE attempts.
references:
  - https://www.securityweek.com/recent-apache-activemq-vulnerability-exploited-in-the-wild/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/java'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
  condition: selection
falsepositives:
  - Legitimate administrative scripts invoked by Java administrators
level: high
---
title: Apache ActiveMQ Exploitation - Java Spawning PowerShell (Windows)
id: 9b5c4d3e-2f0a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects Apache ActiveMQ (java.exe) spawning cmd.exe or powershell.exe on Windows, a high-fidelity indicator of RCE exploitation like CVE-2026-34197.
references:
  - https://www.securityweek.com/recent-apache-activemq-vulnerability-exploited-in-the-wild/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\java.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
falsepositives:
  - Verified administrative troubleshooting via ActiveMQ console scripts
level: critical

// Hunt for ActiveMQ Exploitation (CVE-2026-34197)
// Looks for Java processes spawning shells or obfuscated commands
DeviceProcessEvents
| where InitiatingProcessFileName has "java"
| where ProcessFileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath
| order by Timestamp desc

-- Hunt for suspicious child processes of ActiveMQ (Java)
SELECT Parent.Name AS ParentProcess, Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "java"
  AND Name =~ "(sh|bash|dash|cmd|powershell|pwsh)"

#!/bin/bash
# Remediation Script for CVE-2026-34197
# Identifies vulnerable ActiveMQ versions and recommends actions

ACTIVEMQ_USER="activemq"
# Adjust path if ActiveMQ is installed elsewhere
ACTIVEMQ_HOME="$(eval echo ~$ACTIVEMQ_USER/apache-activemq*)"

if [ ! -d "$ACTIVEMQ_HOME" ]; then
    echo "ActiveMQ home directory not found. Please verify installation path."
    exit 1
fi

# Check for running Java processes associated with ActiveMQ
JAVA_PID=$(pgrep -f "$ACTIVEMQ_HOME")

if [ -n "$JAVA_PID" ]; then
    echo "[!] ActiveMQ is currently running (PID: $JAVA_PID)."
    echo "[*] Checking for signs of compromise..."
    # Check for child processes that are shells
    suspicious_children=$(pstree -p $JAVA_PID | grep -E "(sh|bash|dash|curl|wget|nc)")
    if [ -n "$suspicious_children" ]; then
        echo "[!!!] CRITICAL: Suspicious child process detected!"
        echo "$suspicious_children"
        echo "Immediate incident response investigation required."
    else
        echo "[*] No immediate suspicious child processes detected."
    fi
else
    echo "[*] ActiveMQ process not found running."
fi

echo ""
echo "[+] Remediation Steps:"
echo "1. Upgrade to Apache ActiveMQ 6.1.0 or later (Fixed version)."
echo "2. If upgrade is not immediately possible, restrict access to ports 61616 and 8161 via local firewall (iptables/ufw)."
echo "3. Review logs for unauthorized access attempts in 'data/activemq.log'."