CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache ActiveMQ and 7 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Nov 2, 2023; federal agencies had to remediate by Nov 23, 2023, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
- CVSS
- 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
- Weakness (CWE)
- CWE-502
- Known exploited
- Added to CISA KEV Nov 2, 2023; federal remediation due Nov 23, 2023; known ransomware useApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 99.89% (percentile 100)
- Assigned by
- apache
- NVD analysis
- Analyzed
- Record last updated
- Nov 3, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache ActiveMQ apache_software_foundation:apache_activemq (from the name) | from 5.18.0 before 5.18.3; from 5.17.0 before 5.17.6; from 5.16.0 before 5.16.7; before 5.15.16 | CNA record |
Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module apache_software_foundation:apache_activemq_legacy_openwire_module (from the name) | from 5.18.0 before 5.18.3; from 5.17.0 before 5.17.6; from 5.16.0 before 5.16.7; from 5.8.0 before 5.15.16 | CNA record |
apache activemq apache:activemq | before 5.15.16; from 5.16.0 before 5.16.7; from 5.17.0 before 5.17.6; from 5.18.0 before 5.18.3 | NVD |
apache activemq_legacy_openwire_module apache:activemq_legacy_openwire_module | before 5.15.16; from 5.16.0 before 5.16.7; from 5.17.0 before 5.17.6; from 5.18.0 before 5.18.3 | NVD |
debian debian_linux debian:debian_linux | 10.0; 11.0 | NVD |
netapp e-series_santricity_unified_manager netapp:e-series_santricity_unified_manager | all versions | NVD |
netapp e-series_santricity_web_services_proxy netapp:e-series_santricity_web_services_proxy | all versions | NVD |
netapp santricity_storage_plugin netapp:santricity_storage_plugin | all versions | NVD |
References
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txtvendor-advisory
- https://www.openwall.com/lists/oss-security/2023/10/27/5mailing-list
- https://security.netapp.com/advisory/ntap-20231110-0010/third-party-advisory
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.htmlmailing-list
- http://seclists.org/fulldisclosure/2024/Apr/18mailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.htmlmailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604third-party-advisory, us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.