What’s Vulnerable › Vulnerabilities

CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-11-02
• EPSS: 99.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-27 · updated 2026-06-17
• Weakness: CWE-502

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Affected products

• Apache ActiveMQ: before 5.15.16; from 5.16.0 before 5.16.7; from 5.17.0 before 5.17.6; from 5.18.0 before 5.18.3 — fixed in 5.15.16, 5.16.7, 5.17.6, 5.18.3
• Apache Activemq Legacy Openwire Module: before 5.15.16; from 5.16.0 before 5.16.7; from 5.17.0 before 5.17.6; from 5.18.0 before 5.18.3 — fixed in 5.15.16, 5.16.7, 5.17.6, 5.18.3
• Debian Linux: 10.0, 11.0
• NetApp E-Series Santricity Unified Manager: all versions
• NetApp E-Series Santricity Web Services Proxy: all versions
• NetApp Santricity Storage Plugin: all versions

How to fix

Upgrade to a fixed version: Apache ActiveMQ 5.15.16, 5.16.7, 5.17.6, 5.18.3; Apache Activemq Legacy Openwire Module 5.15.16, 5.16.7, 5.17.6, 5.18.3. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/Apr/18
• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
• https://security.netapp.com/advisory/ntap-20231110-0010/
• https://www.openwall.com/lists/oss-security/2023/10/27/5
• http://seclists.org/fulldisclosure/2024/Apr/18
• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
• https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
• https://security.netapp.com/advisory/ntap-20231110-0010/

Get alerted when CVE-2023-46604 or the next vulnerability affects your stack