CVE-2026-34197: Apache ActiveMQ - Remote Code Execution
HoneyLabs honeypots recorded 10 probes matching CVE-2026-34197 from 3 distinct source IP addresses in the last 7 days, of which 1 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2026-04-16.
One source probed for CVE-2026-34197 on the interactive sensors. It did not send the exploit payload.
What the sensors show
Probes arrived on 2 of the 7 days in this window. The busiest day was 2026-11-12, with 8. One address, 211.154.20.136, sent 70% of them. The largest source network was AS146817 (Hubei Feixun Network Co., Ltd), with 70% of the probes from 1 address. Over the last 90 days the sensors recorded 243 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i181000_85036bcba153_d41ae481755e.
Request paths that identify it
- /api/jolokia/
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 211.154.20.136 | 7 | Hubei Feixun Network Co., Ltd | China |
| 168.107.49.6 | 2 | Oracle Corporation | South Korea |
| 64.93.12.85 | 1 | Atlas Networks Corporation | United States |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS146817 | Hubei Feixun Network Co., Ltd | 7 | 1 |
| AS31898 | Oracle Corporation | 2 | 1 |
| AS21743 | Atlas Networks Corporation | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| China | 7 |
| South Korea | 2 |
| United States | 1 |
Captured requests
- /api/jolokia/version
Requests the interactive sensors answered
- GET /api/jolokia/read/org.apache.activemq:brokerName=localhost,type=Broker/BrokerVersion
HTTP client fingerprints
- b11cun060_00440017_a9482ae2
- b11cun060_10040017_1d464540
- b11cun050_00440013_2619b3ac
CVE report
Open a specific CVE from the CVE tracker.