Detect Apache ActiveMQ Improper Input Validation (CVE-2026-34197) in Splunk
Detects exploitation of CVE-2026-34197, an improper input validation vulnerability (CWE-20/CWE-94) in Apache ActiveMQ that has been added to the CISA Known Exploited Vulnerabilities catalog. Successful exploitation may allow remote attackers to execute arbitrary code or inject malicious content via crafted messages or broker connections. ActiveMQ's OpenWire protocol and web console are common attack surfaces for this class of vulnerability.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
SPL Detection Query
index=* sourcetype IN ("cisco:asa", "pan:traffic", "stream:tcp", "xmlwf", "syslog", "WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval activemq_port=if(dest_port IN (61616, 61617, 8161, 8162, 5672, 1883, 61613) OR src_port IN (61616, 61617, 8161, 8162, 5672, 1883, 61613), 1, 0)
| eval suspicious_cmd=if(match(CommandLine, "(?i)(classinfo|ClassPathXmlApplicationContext|ExceptionResponse|cmd\.exe|/bin/sh|powershell|wget|curl|base64|ncat|/tmp/)"), 1, 0)
| eval suspicious_proc=if(match(ParentImage, "(?i)(activemq|java)") AND suspicious_cmd=1, 1, 0)
| where activemq_port=1 OR suspicious_proc=1
| eval attack_vector=case(suspicious_proc=1, "process_spawn", activemq_port=1 AND suspicious_cmd=1, "network_payload", activemq_port=1, "port_contact", true(), "unknown")
| stats count AS event_count, values(attack_vector) AS attack_vectors, min(_time) AS first_seen, max(_time) AS last_seen, values(dest_ip) AS dest_ips, values(CommandLine) AS command_lines BY src_ip, host
| where event_count >= 1
| eval severity="critical"
| sort -event_countDetects CVE-2026-34197 exploitation attempts in Apache ActiveMQ by identifying anomalous connections to ActiveMQ service ports combined with suspicious child process spawning from Java/ActiveMQ parent processes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate administrative connections to ActiveMQ broker ports from authorized management hosts
- Automated monitoring scripts that spawn child processes from the ActiveMQ service account
- Java application servers co-located with ActiveMQ that naturally communicate on these ports
- Security scanning tools performing authorized vulnerability assessments against ActiveMQ
Other platforms for CVE-2026-34197
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ActiveMQ OpenWire Port Probe with Malicious Payload Pattern
Expected signal: Network connection event to port 61616 from non-standard source; payload content containing 'ClassPathXmlApplicationContext' visible in network capture or IDS alerts
- Test 2Simulated Post-Exploitation Shell Spawn from Java Process
Expected signal: Sysmon Event ID 1 or Linux audit execve showing bash/sh spawned with parent process containing 'java' in the image path; process command line containing 'id', 'hostname', or 'whoami'
- Test 3ActiveMQ Web Console Access with Path Traversal Attempt
Expected signal: HTTP access log entries on port 8161 containing '../' path sequences and 'ClassPathXmlApplicationContext' in request body or destination parameter; network connection events to port 8161 from unexpected source
Response Playbook
Triage
- Confirm the targeted host is running Apache ActiveMQ and identify the version using 'activemq --version' or by inspecting the activemq.jar MANIFEST.MF — cross-reference with the vendor advisory to determine if the version falls within the affected range for CVE-2026-34197.
- Review Apache ActiveMQ broker logs (typically activemq.log or data/activemq.log) for anomalous connection patterns, repeated ExceptionResponse entries, unexpected ClassPathXmlApplicationContext references, or requests with path traversal sequences (../) originating from external IPs.
- Examine the process tree of the ActiveMQ JVM (java.exe / java) for any unexpected child processes such as cmd.exe, powershell.exe, bash, sh, wget, or curl — these indicate successful code execution following exploitation of the input validation flaw.
- Check network flow data for unusual outbound connections from the ActiveMQ host to external IPs on non-standard ports, which may indicate reverse shell or C2 callback activity following successful exploitation.
Containment
- Immediately isolate the affected ActiveMQ broker host from the network at the firewall or host-based firewall level to prevent lateral movement or further data exfiltration while preserving forensic state — do not shut down the process until memory can be captured.
- Block inbound access to all ActiveMQ service ports (61616, 61617, 8161, 8162, 5672, 1883, 61613) from untrusted network segments using firewall ACLs, and restrict the ActiveMQ web console (port 8161) to management VLAN only until the patch is applied and validated.
Evidence Collection
- Capture a full memory dump of the Java process running ActiveMQ using tools such as jmap, procdump (Windows), or /proc/<pid>/mem (Linux) before any remediation steps — heap analysis may reveal injected class objects or deserialized payloads.
- Preserve ActiveMQ broker logs, access logs, and OS-level authentication logs (Windows Event Logs / Linux auth.log) with original timestamps and file integrity hashes (SHA-256) for forensic chain-of-custody — also capture a snapshot of any new or modified files in the ActiveMQ installation directory and temp directories.
Escalation Criteria
- !Escalate immediately to IR if confirmed child process execution is observed from the ActiveMQ JVM, if outbound C2 connections are detected from the broker host, or if evidence of lateral movement (new user accounts, credential access events, SMB/RDP to internal hosts) is found.
- !Escalate if the ActiveMQ broker is deployed in a sensitive environment (payment processing, OT/SCADA integration, identity-adjacent infrastructure) or if the broker is exposed directly to the internet, given CISA KEV designation indicating active in-the-wild exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
ActiveMQ broker log file (activemq.log) containing ExceptionResponse, ClassInfo, or ClassPathXmlApplicationContext strings alongside external source IPs - >
New or modified files in the ActiveMQ installation directory, /tmp, or %TEMP% created by the java process user account around the time of the alert - >
OS process creation events (Sysmon Event ID 1, Linux audit execve) showing java or activemq as parent with shell interpreter as child - >
Network connection records showing the ActiveMQ host initiating outbound connections to external IPs on uncommon ports (indicative of reverse shell)
Tuning Guidance
Start by whitelisting known management hosts and authorized ActiveMQ admin IP ranges to suppress legitimate administrative connections. Tune out Java application servers that co-reside on the same host and legitimately spawn helper scripts. If your environment uses Spring Framework, consider adding exclusions for ClassPathXmlApplicationContext in contexts where the source is an authenticated internal application. Adjust confidence thresholds based on whether your ActiveMQ instance is internet-facing (raise severity) or internal-only (reduce base noise). For the process-spawn detections, build an allowlist of known wrapper scripts (e.g., health-check.sh, restart.sh) that are legitimately launched by the ActiveMQ service account.
Hunting Queries
Hunt for any shell interpreter or download utility spawned as a child of Java or ActiveMQ processes over the past 7 days — this pattern is highly indicative of code execution resulting from CVE-2026-34197 exploitation regardless of network-level detection.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ParentProcessName in~ ("java", "activemq", "activemq.bat")
or (ParentProcessName =~ "java" and ProcessCommandLine has_any (["activemq", "broker"]))
| where ProcessName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "bash", "sh", "dash", "wget", "curl", "nc", "ncat", "python", "python3", "perl", "ruby")
| project TimeGenerated, DeviceName, AccountName, ParentProcessName, ParentProcessId, ProcessName, ProcessCommandLine
| order by TimeGenerated descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where (ParentImage LIKE "%java%" OR ParentImage LIKE "%activemq%")
| where (Image LIKE "%cmd.exe%" OR Image LIKE "%powershell%" OR Image LIKE "%bash%" OR Image LIKE "%wget%" OR Image LIKE "%curl%" OR Image LIKE "%python%" OR Image LIKE "%perl%")
| eval hunt_reason="activemq_suspicious_child"
| stats count BY host, Image, ParentImage, CommandLine, ParentCommandLine
| sort -countAtomic Red Team Tests
Simulates an attacker probing the ActiveMQ OpenWire port and sending a crafted payload containing known exploit indicator strings to test detection coverage at the network layer.
Command
# LAB ONLY - requires Python3 and netcat
# Step 1: Verify ActiveMQ is listening
nc -zv 127.0.0.1 61616
# Step 2: Send probe payload containing exploit indicator string
python3 -c "
import socket, time
s = socket.socket()
s.connect(('127.0.0.1', 61616))
s.sendall(b'\x00\x00\x00\x01\x01\x00ClassPathXmlApplicationContext\x00')
time.sleep(1)
print('Response:', s.recv(1024))
s.close()
"Cleanup
# No cleanup required — this is a read-only probe
echo 'Probe complete — no artifacts to clean'Expected Telemetry
Network connection event to port 61616 from non-standard source; payload content containing 'ClassPathXmlApplicationContext' visible in network capture or IDS alerts
Expected Detection
Should trigger kql, spl, qradar_aql, and sumo_logic queries matching ActiveMQ port connections with suspicious payload patterns
Simulates the post-exploitation behavior of CVE-2026-34197 by manually spawning a shell interpreter as a child of a Java process, mimicking what an attacker-controlled class loader injection would produce.
Command
# LAB ONLY - simulate child shell from java parent
# Requires Java installed
java -cp /dev/null -Djava.class.path=/dev/null \
-Dactivemq.home=/opt/activemq \
-XX:+PrintFlagsFinal \
-version 2>/dev/null & JAVA_PID=$!
sleep 1
# Simulate attacker spawning bash via process substitution
bash -c 'id; hostname; whoami; echo CVE-2026-34197-test' &
echo "Test complete - PID: $JAVA_PID"
kill $JAVA_PID 2>/dev/null || trueCleanup
kill $(pgrep -f 'CVE-2026-34197') 2>/dev/null || true
echo 'Cleanup complete'Expected Telemetry
Sysmon Event ID 1 or Linux audit execve showing bash/sh spawned with parent process containing 'java' in the image path; process command line containing 'id', 'hostname', or 'whoami'
Expected Detection
Should trigger elastic_eql sequence rule and crowdstrike_cql queries matching suspicious child process spawning from Java parent processes
Simulates an attacker attempting path traversal against the ActiveMQ web console (port 8161) as part of CVE-2026-34197 exploitation, testing HTTP-level detection coverage.
Command
# LAB ONLY - test against local ActiveMQ web console
# Requires ActiveMQ running with web console enabled on port 8161
# Test 1: Normal login probe
curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8161/admin/ -u admin:admin
# Test 2: Path traversal attempt
curl -s -o /dev/null -w '%{http_code}' 'http://127.0.0.1:8161/admin/../../etc/passwd'
# Test 3: ClassPathXmlApplicationContext injection probe
curl -s -X POST 'http://127.0.0.1:8161/api/message' \
-H 'Content-Type: application/json' \
-d '{"destination":"ClassPathXmlApplicationContext","body":"test"}' \
-u admin:adminCleanup
echo 'No persistent artifacts created by web console probes'Expected Telemetry
HTTP access log entries on port 8161 containing '../' path sequences and 'ClassPathXmlApplicationContext' in request body or destination parameter; network connection events to port 8161 from unexpected source
Expected Detection
Should trigger kql CommonSecurityLog filter for RequestURL containing path traversal patterns, and qradar_aql payload match for ClassPathXmlApplicationContext on ActiveMQ ports