This critical vulnerability in Apache ActiveMQ is currently being exploited in the wild and allows authenticated attackers to execute arbitrary code on the target system.

This vulnerability involves improper input validation within the Jolokia JMX-HTTP bridge, which permits authenticated users to invoke exec operations on MBeans. By supplying a crafted discovery URI, an attacker can trigger the loading of a remote Spring XML application context, resulting in arbitrary code execution on the broker.

The exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it grants an attacker full control over the affected broker's JVM. With a CVSS score of 9.5, this flaw facilitates complete system compromise, potentially leading to unauthorized data access, lateral movement within the network, and significant operational disruption. The inclusion of this CVE in the CISA Known Exploited Vulnerabilities catalog underscores the high probability of targeted attacks against vulnerable deployments.

Immediate Action: Upgrade to Apache ActiveMQ version 5.19.5 or 6.2.3 immediately to address the underlying input validation flaws.

Proactive Monitoring: Review application logs for suspicious JMX operations or unexpected network connections originating from the ActiveMQ broker. Monitor for the initialization of unusual processes or unexpected Spring framework bean loading activities.

Compensating Controls: Restrict access to the Jolokia JMX-HTTP bridge at the network level, ensuring that only trusted administrative IP addresses can reach the /api/jolokia/ endpoint. Implement Web Application Firewall rules to detect and block requests containing malicious discovery URI patterns.

Public Exploit Available: Yes, a weaponized exploit exists, including a Metasploit module and multiple public proof-of-concept repositories.

Given the confirmed active exploitation and the critical severity of this remote code execution vulnerability, immediate remediation is required for all exposed Apache ActiveMQ instances. Organizations should prioritize patching to version 5.19.5 or 6.2.3 as the primary defense. If immediate patching is not feasible, restrict network access to the management interface to prevent unauthorized exploitation attempts until a permanent fix can be applied.