RSA-2026-06: RSA Governance and Lifecycle Product Security Update for ActiveMQ Vulnerability
RSA Identifier: RSA-2026-06
CVE Identifier: CVE‑2026‑34197
Severity: HIGH (CVE‑2026‑34197)
Severity Rating: CVSS:3.1 - 8.8 High /AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVE‑2026‑34197)
Affected Products
-
-
RSA Governance & Lifecycle 8.0.0 P02 and later, using AFX Server (Access Fulfillment Express)
-
Summary
CVE‑2026‑34197 is an Improper Input Validation and Code Injection vulnerability in Apache ActiveMQ used by the AFX module in RSA Governance & Lifecycle. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge (powered by Jolokia) at /api/jolokia/ via the web console.
Details
An authenticated attacker can exploit this vulnerability by invoking specific operations using a crafted discovery URI. This triggers the VM transport’s brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext, potentially leading to code execution.
This issue affects:
- ActiveMQ versions prior to 5.19.4
- ActiveMQ versions from 6.0.0 up to (but not including) 6.2.3
Impact
In the RSA Governance & Lifecycle environment, the ActiveMQ web console, including the /api/jolokia/ endpoint, is configured to bind to 127.0.0.1 on port 8161. This ensures that access is restricted to the local host only and is not exposed externally over the network. As a result, exploitation would require local system access in addition to any configured authentication controls, thereby significantly limiting the exposure surface.
Given the existing controls in the RSA Governance & Lifecycle environment, and the fact that the APIs are accessible only locally to authorized users, the exposure surface is limited and the overall impact is considered LOW.
Resolution
Both the ActiveMQ web console and /api/jolokia/ in AFX are behind strict authentication and are not exposed beyond the installed server and only accessible on localhost. As it is restricted to only authorized users on localhost, the attack surface is significantly minimized. Consequently, the immediate risk to the G&L implementation of ActiveMQ is considered LOW with regards to this CVE.
To further strengthen the security posture, RSA is in the process of implementing additional hardening measures to block this access even from the local host on AFX server.
Until a full remediation is available, follow the standard security best practices such as:
- Restrict server access to authorized personnel only.
- Ensure that system hardening and access control policies are in place.
- Carry out periodic review of configuration and access controls.
Severity Rating
For an explanation of Severity Ratings, refer to the Security Advisories Severity Rating knowledge base article. RSA recommends all customers consider both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with a security vulnerability.
Legal Information
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Technical Support. RSA Security LLC and its affiliates, including without limitation, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title, and non-infringement. In no event shall RSA, its affiliates, or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits, or special damages, even if RSA, its affiliates, or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
Related Articles
DSA-2019-165: RSA Identity Governance and Lifecycle Product Security Update for Multiple Apache Tomcat Vulnerabilities Number of Views SSA-2022-01: SecurID Governance and Lifecycle Product Security Update for Multiple Vulnerabilities Number of Views RSA-2026-01: RSA Governance and Lifecycle Product Security Update for LDAP Connector - FIPS Mode Enforcement Number of Views RSA-2025-10: RSA Governance and Lifecycle Product Security Update for ActiveMQ Vulnerability Number of Views RSA-2024-15: RSA Governance and Lifecycle Security Update for Oracle Database Vulnerabilities Number of Views
Trending Articles
RSA Authentication Manager Upgrade Process RSA Release Notes for RSA Authentication Manager 8.8 RSA RADIUS Server service failed to start in the RSA Authentication Manager 8.1 Operations Console Microsoft Entra ID External MFA - Relying Party Configuration Using OIDC - RSA Ready Implementation Guide RSA Release Notes: Cloud Access Service and RSA Authenticators
