Every CVE Search/ Get API key

CVE-2016-3088

Improper Input Validation in Apache ActiveMQ

9.8 CriticalIn KEVPublic exploitFix available

CVE-2016-3088 is a critical vulnerability (CVSS 9.8) in Apache Activemq, published June 1, 2016. CISA lists it as known to be exploited, since February 10, 2022. EUVD reports exploitation since February 10, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.5%, the 99th percentile. Fixed in org.apache.activemq:activemq-client 5.14.0.

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

98.5%Up 4.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
CVE-2016-3088
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-434
Updated
2026-11-02
CVE List 9.8

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
CVE-2016-3088
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
EUVDEUVD-2022-5255 9.8

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
EUVD-2022-5255
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rxqh-fc23-gxp2 9.8

Improper Input Validation in Apache ActiveMQ

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
GHSA-rxqh-fc23-gxp2
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20, CWE-434
Updated
2026-11-02
CISA KEV No score

Apache ActiveMQ Improper Input Validation Vulnerability

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

Record
CVE-2016-3088
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
CVE-2016-3088
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-3088 9.8

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
DEBIAN-CVE-2016-3088
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-rxqh-fc23-gxp2 9.8

Improper Input Validation in Apache ActiveMQ

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
GHSA-rxqh-fc23-gxp2
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20, CWE-434
Updated
2026-11-02
OSVUBUNTU-CVE-2016-3088 9.8

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Record
UBUNTU-CVE-2016-3088
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.activemq:activemq-client
Maven
 5.0.0 up to 5.14.0
5.14.0
activemq
Debian:12
 before 5.14.0+dfsg-1
5.14.0+dfsg-1
activemq
Debian:13
 before 5.14.0+dfsg-1
5.14.0+dfsg-1
org.apache.activemq:activemq-client
Maven
 5.0.0 up to 5.14.0, plus listed versions
5.10.05.10.15.10.25.11.05.11.1
Show 16 moreShow less
5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.8.05.9.05.9.1
5.14.0
activemq
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution2015-08-17
MetasploitActiveMQ web shell upload2016-06-01
Exploit-DBActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)2017-06-29
PoC in GitHubMa1Dong/ActiveMQ_putshell-CVE-2016-30882020-07-31
PoC in GitHubwood03mm/CVE-2016-30882020-12-24
PoC in GitHubcyberaguiar/CVE-2016-30882021-03-11
PoC in GitHubvonderchild/CVE-2016-30882021-03-12
PoC in GitHubcl4ym0re/CVE-2016-30882021-07-03
PoC in GitHubYutuSec/ActiveMQ_Crack2022-04-02
PoC in GitHubHeArtE4t3r/CVE-2016-30882025-06-16
PoC in GitHubCatherines77/ActiveMQ-EXPtools2026-04-20
PoC in GitHubCyberCTF/vulhub-activemq-cve-2016-30882026-10-08
NucleiApache ActiveMQ Fileserver - Arbitrary File Write

History

History
WhenChangedSources
2026-11-03exploitation, exploits
2026-11-02createdCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open