NVD / CVE Program· CNA apache

CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

CriticalCVSS 9.8 · v3.1KEVWeaponized Fix available

Noroxi assessment

Priority: Now (action score 99/100)

CISA has confirmed exploitation in the wild (Nov 2, 2023); it is known to be used in ransomware campaigns. Remediation deadline for US federal agencies: Nov 23, 2023.
A ready-made attack module is public (Metasploit, Nuclei); exploiting it takes no special expertise.
Probability of exploitation in the next 30 days: 99.9% (FIRST EPSS); higher than 99.9% of all records.
Anyone who can reach it over the internet can trigger it. No account or password is required. No user action is required. No special conditions are required; it is repeatable.
According to CISA the attack is automatable: targets can be found by mass scanning.
Fixed version: Apache Software Foundation Apache ActiveMQ 5.15.16, 5.16.7, 5.17.6; Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module 5.15.16, 5.16.7, 5.17.6.
Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).

Patch today or shut off access. Upgrade to Apache Software Foundation Apache ActiveMQ 5.15.16, 5.16.7, 5.17.6; Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module 5.15.16, 5.16.7, 5.17.6 or later.

Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it

Primary sources: NVD · CVE.org · CISA KEV · FIRST EPSS

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Published: Oct 27, 2023
Updated: Jun 17, 2026
EPSS: 99.9% · 99th percentile
CWE: CWE-502

Report tools

JSON

Action score

Now

Patch today or shut off access.

CVSS: 39 / 40 · 9.8 / 10
CISA KEV: 30 / 30 · Listed
EPSS: 30 / 30 · 99.9%

CISA SSVC decision

Exploitation: active
Automatable: yes
Technical impact: total

Vulnrichment: CISA's decision-tree inputs.

CNA vs NVD score

NVD: 9.8
CNA · apache: 10.0; 0.2 point gap

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.

Actively exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on Nov 2, 2023. That signals real attacks, not theory.

Remediation deadline for US federal agencies: Nov 23, 2023.

Known to be used in ransomware campaigns.

Get told when this record changes

In CISA KEV: exploitation in the wild confirmed
Weaponized exploit exists
A fix has been released

If any of these changes, we'll tell you in the daily email digest.

Is your version affected? Check it

Noroxi analysis

What does it mean in your environment?

The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.

We use this product, ask for help

Affected systems

Is your version affected?

Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.

Vendor	Product	CPE
apache	activemq	cpe:2.3:a:apache:activemq
apache	activemq legacy openwire module	cpe:2.3:a:apache:activemq_legacy_openwire_module
debian	debian linux	cpe:2.3:o:debian:debian_linux
netapp	e-series santricity unified manager	cpe:2.3:a:netapp:e-series_santricity_unified_manager
netapp	e-series santricity web services proxy	cpe:2.3:a:netapp:e-series_santricity_web_services_proxy
netapp	santricity storage plugin	cpe:2.3:a:netapp:santricity_storage_plugin

Versions reported by the vendor

Affected version ranges reported by the assigning authority (apache). Independent of NVD's CPE analysis and usually ahead of it.

Apache Software Foundation Apache ActiveMQ
- 5.18.0 and later · before 5.18.3affected · semver
- 5.17.0 and later · before 5.17.6affected · semver
- 5.16.0 and later · before 5.16.7affected · semver
- before 5.15.16affected · semver
Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module
- 5.18.0 and later · before 5.18.3affected · semver
- 5.17.0 and later · before 5.17.6affected · semver
- 5.16.0 and later · before 5.16.7affected · semver
- 5.8.0 and later · before 5.15.16affected · semver

Affected versions · NVD (13)

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

apache activemqbefore 5.15.16
apache activemq5.16.0 and later · before 5.16.7
apache activemq5.17.0 and later · before 5.17.6
apache activemq5.18.0 and later · before 5.18.3
apache activemq legacy openwire modulebefore 5.15.16
apache activemq legacy openwire module5.16.0 and later · before 5.16.7
apache activemq legacy openwire module5.17.0 and later · before 5.17.6
apache activemq legacy openwire module5.18.0 and later · before 5.18.3
debian debian linux10.0
debian debian linux11.0
netapp e-series santricity unified managerall versions
netapp e-series santricity web services proxyall versions
netapp santricity storage pluginall versions

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Ecosystem	Package	Affected range	Fix
Debian:10	activemq	before 5.15.16-0+deb10u1	5.15.16-0+deb10u1
Debian:11	activemq	before 5.16.1-1+deb11u1	5.16.1-1+deb11u1
Debian:12	activemq	before 5.17.2+dfsg-2+deb12u1	5.17.2+dfsg-2+deb12u1
Debian:13	activemq	before 5.17.6+dfsg-1	5.17.6+dfsg-1
Maven	org.apache.activemq:activemq-client	from 5.16.0 · before 5.16.7	5.16.7
Maven	org.apache.activemq:activemq-client	from 5.17.0 · before 5.17.6	5.17.6
Maven	org.apache.activemq:activemq-client	from 5.18.0 · before 5.18.3	5.18.3
Maven	org.apache.activemq:activemq-client	before 5.15.16	5.15.16
Maven	org.apache.activemq:activemq-openwire-legacy	from 5.16.0 · before 5.16.7	5.16.7
Maven	org.apache.activemq:activemq-openwire-legacy	from 5.17.0 · before 5.17.6	5.17.6
Maven	org.apache.activemq:activemq-openwire-legacy	from 5.18.0 · before 5.18.3	5.18.3
Maven	org.apache.activemq:activemq-openwire-legacy	from 5.8.0 · before 5.15.16	5.15.16

Same product

apache: all records

Other highest-scoring records for the same primary product.

CVE-2016-3088The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an…KEV
99Now
CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansKEV
94Now
CVE-2022-41678Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
61This week

Published before and after this one in the same product

← EarlierCVE-2021-26117Jan 27, 2021 · ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
33Monitor
← EarlierCVE-2020-13947Feb 8, 2021 · An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp…
48Plan
Later →CVE-2024-32114May 2, 2024 · Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
37Monitor

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

Product / package	Fixed version	Source
Apache Software Foundation Apache ActiveMQ	5.15.16	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ	5.16.7	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ	5.17.6	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ	5.18.3	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module	5.15.16	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module	5.16.7	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module	5.17.6	Vendor (CNA)
Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module	5.18.3	Vendor (CNA)
debian:activemq	5.17.2+dfsg-2+deb12u1 · Debian:12	Package registry (OSV)
Maven:org.apache.activemq:activemq-client	5.15.16	Package registry (OSV)
Maven:org.apache.activemq:activemq-client	5.16.7	Package registry (OSV)
Maven:org.apache.activemq:activemq-client	5.17.6	Package registry (OSV)
Maven:org.apache.activemq:activemq-client	5.18.3	Package registry (OSV)
Maven:org.apache.activemq:activemq-openwire-legacy	5.15.16	Package registry (OSV)
Maven:org.apache.activemq:activemq-openwire-legacy	5.16.7	Package registry (OSV)
Maven:org.apache.activemq:activemq-openwire-legacy	5.17.6	Package registry (OSV)
Maven:org.apache.activemq:activemq-openwire-legacy	5.18.3	Package registry (OSV)

Exploit status

Weaponized

A ready exploit tool or active in-the-wild use is known for this vulnerability. This should be your top priority.

Evidence

Metasploit module ×1
Nuclei detection template ×1
Proof-of-concept repository on GitHub ×44

Noroxi does not host or link to exploit code. Metasploit module names and Nuclei template ids are shown (names, not code); Exploit-DB entries and PoC repositories are given as counts only.

Public exploit evidence
Source	Kind	Date
Proof-of-concept repository on GitHub	44 repositories	2023-10-26 → 2026-11-11
Metasploit module	exploit/multi/misc/apache_activemq_rce_cve_2023_46604Apache ActiveMQ Unauthenticated Remote Code Executionexploit	2023-10-27
Nuclei detection template	Nuclei template CVE-2023-46604	—

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.

Timeline

From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.

First PoCOct 26, 2023-1 d
MetasploitOct 27, 2023same day
PublishedOct 27, 2023
CISA KEVNov 2, 2023+6 d
TodayNov 13, 2026+1113 d

Credits

All researchers

Finders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.

yejie@threatbook.cnfinder

National notice (Türkiye Cybersecurity Directorate / USOM)

Official security notices citing this record; remediation advice is on the agency's page.

TR-23-0624 · Nov 6, 2023(Apache ActiveMQ Zafiyeti)

All national notices →

Not on record for this CVE: EPSS history · patch commit or PR link · variant or chain candidate · public bounty program.

Technical details

Attack conditions

Anyone who can reach it over the internet can trigger it.
No account or password is required.
No user action is required.
No special conditions are required; it is repeatable.

If successful

Confidentiality: high · data can be read
Integrity: high · data or configuration can be modified
Availability: high · the service can be disrupted

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

Weakness class (CWE)

CWE-502 · Deserialization of Untrusted Data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd-primary

Root cause

Data received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.

The bug in code

The whole CWE-502 class

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

Vulnerable

python

1payload = sock.recv(65536)
2job = pickle.loads(payload)

Fixed

python

1payload = sock.recv(65536)
2if not hmac.compare_digest(sign(payload), header_sig):
3    raise PermissionError("invalid signature")
4job = JobSchema.validate(json.loads(payload))