diff --git a/docs/Modules.md b/docs/Modules.md
index 449eff140..1ff49e6a3 100644
--- a/docs/Modules.md
+++ b/docs/Modules.md
@@ -128,7 +128,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 `60443, 61532, 61900, 62078, 63331, 64623, 64680, 65000, 65129, 65389]`
 
 ## Vuln Modules
-
+- '**activemq_cve_2026_34197_jolokia_rce_vuln**' - check Jolokia endpoint for RCE vulnerability CVE-2026-34197
 - '**aiohttp_cve_2024_23334_vuln**' - check the target for CVE-2024-23334
 - '**apache_ofbiz_cve_2024_38856**' - check the target for Apache OFBiz CVE-2024-38856
 - '**apache_struts_vuln**' - check Apache Struts for CVE-2017-5638
diff --git a/nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml b/nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml
new file mode 100644
index 000000000..c205b4285
--- /dev/null
+++ b/nettacker/modules/vuln/activemq_cve_2026_34197_jolokia_rce.yaml
@@ -0,0 +1,187 @@
+info:
+  name: activemq_cve_2026_34197_jolokia_rce_vuln
+  author: Nettacker Team
+  severity: 8.8
+  description: |
+    Detects CVE-2026-34197 in Apache ActiveMQ Classic via Jolokia API.
+    The vulnerability allows execution of addNetworkConnector which can
+    load remote configuration via vm:// and xbean: protocol.
+    Detection is performed by invoking addNetworkConnector via the Jolokia
+    exec API with a benign vm:// URI (brokerConfig=none); patched brokers
+    (5.19.4 / 6.2.3) reject vm:// transport for this operation.
+    Note: on vulnerable brokers this creates a persistent network
+    connector entry that remains until broker restart or manual removal.
+
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-34197
+    - https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/
+    - https://www.cisa.gov/news-events/alerts/2026/04/16/cisa-adds-one-known-exploited-vulnerability-catalog
+
+  profiles:
+    - vuln
+    - http
+    - high_severity
+    - cve
+    - cve2026
+    - activemq
+    - jolokia
+    - rce
+    - cisa_kev
+
+payloads:
+  - library: http
+    steps:
+      - method: post
+        timeout: 10
+        headers:
+          User-Agent: "{user_agent}"
+          Content-Type: "application/json"
+          Authorization: "Basic YWRtaW46YWRtaW4="
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 8161
+                - 80
+                - 443
+
+        data: |
+          {{
+            "type": "exec",
+            "mbean": "org.apache.activemq:type=Broker,brokerName=localhost",
+            "operation": "addNetworkConnector",
+            "arguments": ["static:(vm://nettacker-probe-000?brokerConfig=none)"]
+          }}
+
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: '200'
+              reverse: false
+            content:
+              regex: '(?s)(?=.*addNetworkConnector)(?=.*org.apache.activemq)'
+              reverse: false
+
+      - method: post
+        timeout: 10
+        headers:
+          User-Agent: "{user_agent}"
+          Content-Type: "application/json"
+          Authorization: "Basic YWRtaW46YWRtaW4="
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 8161
+                - 80
+                - 443
+
+        data: |
+          {{
+            "type": "exec",
+            "mbean": "org.apache.activemq:type=Broker,brokerName=localhost",
+            "operation": "removeNetworkConnector",
+            "arguments": ["NC"]
+          }}
+
+        response:
+          save_to_temp_events_only: cleanup_step_1
+          condition_type: and
+          conditions:
+            status_code:
+              regex: '200'
+              reverse: false
+        
+
+      - method: post
+        timeout: 10
+        headers:
+          User-Agent: "{user_agent}"
+          Content-Type: "application/json"
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 8161
+                - 80
+                - 443
+
+        data: |
+          {{
+            "type": "exec",
+            "mbean": "org.apache.activemq:type=Broker,brokerName=localhost",
+            "operation": "addNetworkConnector",
+            "arguments": ["static:(vm://nettacker-probe-000?brokerConfig=none)"]
+          }}
+
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: '200'
+              reverse: false
+            content:
+              regex: '(?s)(?=.*addNetworkConnector)(?=.*org.apache.activemq)'
+              reverse: false
+
+      - method: post
+        timeout: 10
+        headers:
+          User-Agent: "{user_agent}"
+          Content-Type: "application/json"
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/api/jolokia/"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 8161
+                - 80
+                - 443
+
+        data: |
+          {{
+            "type": "exec",
+            "mbean": "org.apache.activemq:type=Broker,brokerName=localhost",
+            "operation": "removeNetworkConnector",
+            "arguments": ["NC"]
+          }}
+
+        response:
+          save_to_temp_events_only: cleanup_step_2
+          condition_type: and
+          conditions:
+            status_code:
+              regex: '200'
+              reverse: false