{"id":"CVE-2026-34197","kind":"vulnerability","aliases":["CVE-2026-34197"],"related":[],"title":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache…","description":"WAF Release - 2026-04-21 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 21, 2026\n\n## WAF Release - 2026-04-21\n\nThis week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers.\n\nKey Findings\n\n- Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise.\n- Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities.\n\nContinuous Rule Improvements\n\nWe are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...ee159e2e | N/A | Command Injection - Generic 8 - uri | Log | Block | This is a new detection. Previous description was \"Command Injection - Generic 8 - uri - Beta\" |\n| Cloudflare Managed Ruleset | ...a15308cf | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This is a new detection. This rule is merged into the original rule \"Command Injection - Generic 8 - body\" (ID: ...413592e2). The rule previously known as \"Command Injection - Generic 8\" is now renamed to \"Command Injection - Generic 8 - body\". |\n| Cloudflare Managed Ruleset | ...958047ed | N/A | MySQL - SQLi - Executable Comment - Beta | Log | Block | This is a new detection. This rule is merged into the original rule \"MySQL - SQLi - Executable Comment - Body\" (ID: ...7bd2d8fa) The rule previously known as \"MySQL - SQLi - Executable Comment\" is now renamed to \"MySQL - SQLi - Executable Comment - Body\". |\n| Cloudflare Managed Ruleset | ...582cc559 | N/A | MySQL - SQLi - Executable Comment - Headers | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a16639d3 | N/A | MySQL - SQLi - Executable Comment - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...44f24211 | N/A | Magento 2 - Unrestricted file upload - 2 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...bf170a17 | N/A | Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8c2ac1a7 | N/A | SQLi - Sleep Function - Beta | Log | Block | This is a new detection. This rule is merged into the original rule \"SQLi - Sleep Function\" (ID: ...f77e8d54) |\n| Cloudflare Managed Ruleset | ...4dacaeb8 | N/A | SQLi - Sleep Function - Headers | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ed4c9ece | N/A | SQLi - Sleep Function - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...1dfa64df | N/A | SQLi - Probing - uri | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...4c62e2e7 | N/A | SQLi - Probing - header | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...aab28ea1 | N/A | SQLi - Probing - body | Disabled | Disabled | This is a new detection. This rule is merged into the original rule \"SQLi - Probing\" (ID: ...b4026c88) |\n| Cloudflare Managed Ruleset | ...20999be0 | N/A | SQLi - Probing 2 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. |\n| Cloudflare Managed Ruleset | ...d7aa0008 | N/A | SQLi - UNION in MSSQL - Body | Disabled | Disabled | This rule has been renamed to differentiate from \"SQLi - UNION in MSSQL\" (ID: ...ee5e35fd) and contains updated rule logic. |\n| Cloudflare Managed Ruleset | ...a67d8561 | N/A | SQLi - UNION - 3 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI | Disabled | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70282f38 | N/A | XSS, HTML Injection - Embed Tag - Headers | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...23f4d718 | N/A | XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...6978def1 | N/A | XSS, HTML Injection - Link Tag - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI | Disabled | Disabled | This is a new detection. |","summary":"Apache ActiveMQ has an improper input validation flaw that allows code injection. Attackers can exploit it in the wild, which is what CISA's catalog records.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-04-16T00:00:00+00:00","products":[{"name":"apache activemq","fixed":["5.19.4"],"affected":"< 5.19.4","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.3"],"affected":">= 6.0.0, < 6.2.3","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["5.19.4"],"affected":"< 5.19.4","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["6.2.3"],"affected":">= 6.0.0, < 6.2.3","ecosystem":"vendor"},{"name":"Apache ActiveMQ","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["activemq","cloudflare","exploited","java","lab-disclosure","package","self-hosted"],"not_affected_if":["not-running-activemq"],"how_to_check":null,"fix":"Apply vendor mitigations per the Apache advisory; CISA says to discontinue use if mitigations are unavailable. Affected and fixed versions: unknown.","status":"open","published_at":"2026-04-07T09:16:20+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:48+00:00","updated_at":"2026-10-24T19:12:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T20:38:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply vendor mitigations per the Apache advisory; CISA says to discontinue use if mitigations are unavailable. Affected and fixed versions: unknown.","reach":"unknown","summary":"Apache ActiveMQ has an improper input validation flaw that allows code injection. Attackers can exploit it in the wild, which is what CISA's catalog records.","category":"package","who_cares":["activemq","java","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker injects code into the ActiveMQ broker, potentially running commands on the server.","analyst_note":"Find affected and fixed versions, exposure conditions and mitigation steps in the Apache ActiveMQ security advisory for CVE-2026-34197.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-activemq"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000423,"input_tokens":2514,"output_tokens":344,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':73C,89C '-2026':16A,19A,110C,146C,487C '-21':74C,90C '-34197':17A,20A,111C,147C,488C '1dfa64df':560C '2':118C,180C,184C,463C,467C '2026':72C,85C,88C '21':84C '413592e2':354C '44f24211':460C '4c62e2e7':575C '4dacaeb8':528C '582cc559':426C '7bd2d8fa':404C '8':304C,319C,330C,351C,363C,371C '8c2ac1a7':499C '958047ed':376C 'a15308cf':325C 'a16639d3':443C 'aab28ea1':590C 'action':278C,292C,294C 'activemq':22A,24A,26A,29A,32A,33B,45B,108C,144C,152C,232C,481C 'address':236C 'adjust':276C 'administr':218C 'adob':199C 'affect':221C 'allow':53B,153C,208C 'alongsid':122C 'apach':14A,44B,107C,143C,151C,231C,480C 'apache':21A,23A,25A,28A,31A 'appli':226C 'april':83C 'arbitrari':160C,213C 'attack':56B,157C,210C,259C 'beta':321C,332C,382C,504C 'bf170a17':478C 'block':307C,384C,434C,451C,469C,490C,506C,535C,551C,566C,581C 'bodi':331C,352C,372C,402C,422C,594C 'broker':27A,30A 'catalog':68B 'changelog':75C,76C 'cisa':66B 'cloudflar':34B,82C,296C,322C,373C,423C,440C,457C,475C,496C,525C,541C,557C,572C,587C 'code':9A,10A,54B,102C,161C,214C,483C 'command':301C,316C,327C,348C,360C,368C 'comment':295C,381C,401C,413C,421C,431C,448C 'commerc':200C 'compromis':178C 'consist':269C 'continu':127C,240C,245C 'control':5A,219C 'could':207C 'craft':170C 'custom':140C 'cve':15A,18A,109C,145C,485C,486C 'dashboard':274C 'deeper':135C,256C 'deploy':283C 'descript':290C,314C 'detect':98C,124C,312C,339C,389C,439C,456C,474C,495C,511C,540C,556C,571C,586C,601C 'disabl':333C,334C,595C,596C 'disclosur':39B 'ed4c9ece':544C 'ee159e2e':299C 'enhanc':191C,281C 'ensur':262C 'event':273C 'execut':103C,159C,212C,380C,400C,412C,420C,430C,447C,484C 'exist':194C 'exploit':35B,58B,203C 'f77e8d54':524C 'file':120C,182C,465C 'find':142C 'flaw':51B,163C 'follow':189C 'follow-up':188C 'full':176C,217C 'function':503C,522C,532C,548C 'gain':216C 'generat':7A 'generic':303C,318C,329C,350C,362C,370C 'header':432C,533C,579C 'host':43B 'id':286C,289C,353C,403C,523C 'impact':201C 'improp':1A,4A,48B 'improv':80C,242C 'inject':11A,55B,302C,317C,328C,349C,361C,369C 'input':2A,49B 'insight':137C,257C 'introduc':95C 'java':36B 'key':141C 'known':358C,408C 'lab':38B 'lab-disclosur':37B 'lead':173C 'legaci':287C 'log':306C,383C,433C,450C,468C,489C,505C,534C,550C,565C,580C 'magento':117C,179C,197C,234C,462C 'manag':248C,297C,323C,374C,424C,441C,458C,476C,497C,526C,542C,558C,573C,588C 'merg':343C,393C,515C,605C 'monitor':270C 'mysql':378C,398C,410C,418C,428C,445C 'n/a':300C,326C,377C,427C,444C,461C,479C,500C,529C,545C,561C,576C,591C 'network':171C 'new':77C,97C,293C,311C,338C,388C,438C,455C,473C,494C,510C,539C,555C,570C,585C,600C 'occur':164C 'offici':227C 'optim':264C 'origin':346C,396C,518C,608C 'packag':40B 'packet':172C 'patch':229C 'pattern':260C 'postur':266C 'potenti':175C 'previous':291C,313C,357C,407C 'probe':563C,578C,593C 'process':167C 'protect':195C,254C 'provid':134C,251C 'rce':104C 'recommend':225C,268C 'record':69B 'refin':132C,246C 'releas':71C,87C,94C 'remot':101C,156C,482C 'renam':366C,416C 'resili':253C 'rule':131C,241C,249C,277C,285C,288C,341C,347C,356C,391C,397C,406C,513C,519C,603C 'ruleset':284C,298C,324C,375C,425C,442C,459C,477C,498C,527C,543C,559C,574C,589C 'secur':136C,265C,272C 'self':42B 'self-host':41B 'server':222C 'signatur':115C 'sleep':502C,521C,531C,547C 'special':169C 'sqli':379C,399C,411C,419C,429C,446C,501C,520C,530C,546C,562C,577C,592C 'strong':224C 'success':202C 'system':177C 'unauthent':155C,209C 'under':238C 'unrestrict':119C,181C,464C 'updat':78C,114C 'upload':121C,183C,466C 'uri':305C,320C,449C,549C,564C 'valid':3A,50B 'vendor':228C 'vulner':12A,105C,149C,206C,239C 'waf':70C,86C 'week':92C 'wild':62B 'work':129C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-04-21","covers":"HTTP requests proxied through Cloudflare matched by the Cloudflare Managed Ruleset rule 'Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197' (action changed from Log to Block)","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-04-21-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:11:55Z","confidence":0.9,"source_title":"WAF Release - 2026-04-21 · Changelog","customer_action":"apply the official Apache ActiveMQ vendor patch; the rule is a detection layer, not the fix"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-07T09:16:20+00:00","kev":{"dateAdded":"2026-04-16","dueDate":"2026-04-30","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34197","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34197","severity":null,"published_at":"2026-04-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-34197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34197","severity":null,"published_at":"2026-04-07T09:16:20+00:00","modified_at":"2026-08-04T13:18:20+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-21-waf-release/#CVE-2026-34197","url":"https://developers.cloudflare.com/changelog/post/2026-04-21-waf-release/","severity":null,"published_at":"2026-04-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-21 · Changelog"}],"documents":[{"id":2920,"url":"https://developers.cloudflare.com/changelog/post/2026-04-21-waf-release/","title":"Cloudflare: WAF Release - 2026-04-21 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-21 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 21, 2026\n\n## WAF Release - 2026-04-21\n\nThis week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers.\n\nKey Findings\n\n- Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise.\n- Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities.\n\nContinuous Rule Improvements\n\nWe are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...ee159e2e | N/A | Command Injection - Generic 8 - uri | Log | Block | This is a new detection. Previous description was \"Command Injection - Generic 8 - uri - Beta\" |\n| Cloudflare Managed Ruleset | ...a15308cf | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This is a new detection. This rule is merged into the original rule \"Command Injection - Generic 8 - body\" (ID: ...413592e2). The rule previously known as \"Command Injection - Generic 8\" is now renamed to \"Command Injection - Generic 8 - body\". |\n| Cloudflare Managed Ruleset | ...958047ed | N/A | MySQL - SQLi - Executable Comment - Beta | Log | Block | This is a new detection. This rule is merged into the original rule \"MySQL - SQLi - Executable Comment - Body\" (ID: ...7bd2d8fa) The rule previously known as \"MySQL - SQLi - Executable Comment\" is now renamed to \"MySQL - SQLi - Executable Comment - Body\". |\n| Cloudflare Managed Ruleset | ...582cc559 | N/A | MySQL - SQLi - Executable Comment - Headers | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a16639d3 | N/A | MySQL - SQLi - Executable Comment - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...44f24211 | N/A | Magento 2 - Unrestricted file upload - 2 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...bf170a17 | N/A | Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8c2ac1a7 | N/A | SQLi - Sleep Function - Beta | Log | Block | This is a new detection. This rule is merged into the original rule \"SQLi - Sleep Function\" (ID: ...f77e8d54) |\n| Cloudflare Managed Ruleset | ...4dacaeb8 | N/A | SQLi - Sleep Function - Headers | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ed4c9ece | N/A | SQLi - Sleep Function - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...1dfa64df | N/A | SQLi - Probing - uri | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...4c62e2e7 | N/A | SQLi - Probing - header | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...aab28ea1 | N/A | SQLi - Probing - body | Disabled | Disabled | This is a new detection. This rule is merged into the original rule \"SQLi - Probing\" (ID: ...b4026c88) |\n| Cloudflare Managed Ruleset | ...20999be0 | N/A | SQLi - Probing 2 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. |\n| Cloudflare Managed Ruleset | ...d7aa0008 | N/A | SQLi - UNION in MSSQL - Body | Disabled | Disabled | This rule has been renamed to differentiate from \"SQLi - UNION in MSSQL\" (ID: ...ee5e35fd) and contains updated rule logic. |\n| Cloudflare Managed Ruleset | ...a67d8561 | N/A | SQLi - UNION - 3 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI | Disabled | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70282f38 | N/A | XSS, HTML Injection - Embed Tag - Headers | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...23f4d718 | N/A | XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...6978def1 | N/A | XSS, HTML Injection - Link Tag - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI | Disabled | Disabled | This is a new detection. |","published_at":"2026-04-21T00:00:00+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}