Every CVE Search/ Get API key

CVE-2023-46604

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

10.0 CriticalIn KEVPublic exploitFix available

CVE-2023-46604 is a critical vulnerability (CVSS 10.0) in Apache Activemq, published October 27, 2023. CISA lists it as known to be exploited, since November 2, 2023. EUVD reports exploitation since November 2, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in org.apache.activemq:activemq-client 5.15.16.

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 99.9 points since Oct 28, 2023
90%50%10%1%

What each source reports

CVE List Score used 10.0

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
CVE-2023-46604
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2023-2719 10.0

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
EUVD-2023-2719
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-crg9-44h2-xw35 10.0

Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. 

Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Record
GHSA-crg9-44h2-xw35
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H
Weakness
CWE-502
Updated
2026-11-02
CISA KEV No score

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Record
CVE-2023-46604
Weakness
CWE-502
Updated
2026-11-02
NVD 10.0

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
CVE-2023-46604
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 10.0

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
CVE-2023-46604
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2023-46604 9.8

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
DEBIAN-CVE-2023-46604
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-crg9-44h2-xw35 10.0

Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. 

Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Record
GHSA-crg9-44h2-xw35
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H
Weakness
CWE-502
Updated
2026-11-02
OSVOESA-2023-1778 10.0

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. 

Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.(CVE-2023-46604)

Record
OESA-2023-1778
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-46604 10.0

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
UBUNTU-CVE-2023-46604
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-activemq-2023-46604 No score

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Record
BIT-activemq-2023-46604
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2023-46604 No score

CVE-2023-46604 in io.root.org.apache.activemq:activemq-client - Patched by Root

Root has patched CVE-2023-46604 in the io.root.org.apache.activemq:activemq-client package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2023-46604
Updated
2026-11-02
OSVUSN-6910-1 No score

activemq vulnerabilities

Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain commands. A remote attacker could possibly use this issue to terminate the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-7559)

Peter Stöckli discovered that Apache ActiveMQ incorrectly handled hostname verification. A remote attacker could possibly use this issue to perform a person-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-11775)

Jonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache ActiveMQ incorrectly handled authentication in certain functions. A remote attacker could possibly use this issue to perform a person-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-13920)

Gregor Tudan discovered that Apache ActiveMQ incorrectly handled LDAP authentication. A remote attacker could possibly use this issue to acquire unauthenticated access. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-26117)

It was discovered that Apache ActiveMQ incorrectly handled authentication. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2022-41678)

It was discovered that Apache ActiveMQ incorrectly handled deserialization. A remote attacker could possibly use this issue to run arbitrary shell commands. (CVE-2023-46604)

Record
USN-6910-1
Updated
2026-11-02
OSVUSN-7268-1 No score

activemq vulnerabilities

It was discovered that Apache ActiveMQ incorrectly handled authentication. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2022-41678)

It was discovered that Apache ActiveMQ incorrectly handled deserialization. A remote attacker could possibly use this issue to run arbitrary shell commands. (CVE-2023-46604)

Record
USN-7268-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.activemq:activemq-client
Maven
 before 5.15.16
5.15.16
org.apache.activemq:activemq-client
Maven
 5.16.0 up to 5.16.7
5.16.7
org.apache.activemq:activemq-client
Maven
 5.17.0 up to 5.17.6
5.17.6
org.apache.activemq:activemq-client
Maven
 5.18.0 up to 5.18.3
5.18.3
org.apache.activemq:activemq-openwire-legacy
Maven
 5.8.0 up to 5.15.16
5.15.16
org.apache.activemq:activemq-openwire-legacy
Maven
 5.16.0 up to 5.16.7
5.16.7
org.apache.activemq:activemq-openwire-legacy
Maven
 5.17.0 up to 5.17.6
5.17.6
org.apache.activemq:activemq-openwire-legacy
Maven
 5.18.0 up to 5.18.3
5.18.3
activemq
Bitnami
 before 5.15.16, 5.16.0 up to 5.16.7, 5.17.0 up to 5.17.6, 5.18.0 up to 5.18.3
5.15.165.16.75.17.65.18.3
activemq
Debian:12
 before 5.17.2+dfsg-2+deb12u1, plus listed versions
5.17.2+dfsg-2
5.17.2+dfsg-2+deb12u1
Show 25 moreShow less
Affected packages
PackageAffectedFixed
activemq
Debian:13
 before 5.17.6+dfsg-1
5.17.6+dfsg-1
activemq
Debian:10
 before 5.15.16-0+deb10u1, plus listed versions
5.15.10-15.15.11-15.15.8-25.15.9-1
5.15.16-0+deb10u1
activemq
Debian:11
 before 5.16.1-1+deb11u1, plus listed versions
5.16.1-1
5.16.1-1+deb11u1
org.apache.activemq:activemq-client
Maven
 before 5.15.16, plus listed versions
5.10.05.10.15.10.25.11.05.11.1
Show 38 moreShow less
5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.125.15.135.15.145.15.155.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.8.05.9.05.9.1
5.15.16
org.apache.activemq:activemq-client
Maven
 5.16.0 up to 5.16.7, plus listed versions
5.16.15.16.25.16.35.16.45.16.55.16.6
5.16.7
org.apache.activemq:activemq-client
Maven
 5.17.0 up to 5.17.6, plus listed versions
5.17.15.17.25.17.35.17.45.17.5
5.17.6
org.apache.activemq:activemq-client
Maven
 5.18.0 up to 5.18.3, plus listed versions
5.18.15.18.2
5.18.3
org.apache.activemq:activemq-openwire-legacy
Maven
 5.8.0 up to 5.15.16, plus listed versions
5.10.05.10.15.10.25.11.05.11.1
Show 37 moreShow less
5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.125.15.135.15.145.15.155.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.9.05.9.1
5.15.16
org.apache.activemq:activemq-openwire-legacy
Maven
 5.16.0 up to 5.16.7, plus listed versions
5.16.15.16.25.16.35.16.45.16.55.16.6
5.16.7
org.apache.activemq:activemq-openwire-legacy
Maven
 5.17.0 up to 5.17.6, plus listed versions
5.17.15.17.25.17.35.17.45.17.5
5.17.6
org.apache.activemq:activemq-openwire-legacy
Maven
 5.18.0 up to 5.18.3, plus listed versions
5.18.15.18.2
5.18.3
activemq
openEuler:20.03-LTS-SP1
 before 5.15.16-1.oe1
5.15.16-1.oe1
activemq
openEuler:20.03-LTS-SP3
 before 5.15.16-1.oe1
5.15.16-1.oe1
activemq
openEuler:22.03-LTS
 before 5.15.16-1.oe2203sp2
5.15.16-1.oe2203sp2
activemq
openEuler:22.03-LTS-SP1
 before 5.15.16-1.oe2203sp1
5.15.16-1.oe2203sp1
activemq
openEuler:22.03-LTS-SP2
 before 5.15.16-1.oe2203sp2
5.15.16-1.oe2203sp2
io.root.org.apache.activemq:activemq-client
Root:Maven
 before 5.18.3-root.io.2
5.18.3-root.io.25.18.3-root.io.35.18.3-root.io.75.18.3-root.io.85.18.3-root.io.95.18.3-root.io.105.18.3-root.io.115.18.3-root.io.12
io.root.org.apache.activemq:activemq-openwire-legacy
Root:Maven
 before 5.18.3-root.io.4
5.18.3-root.io.45.18.3-root.io.85.18.3-root.io.95.18.3-root.io.105.18.3-root.io.115.18.3-root.io.12
org.apache.activemq:activemq-client
Root:Maven
 before 5.18.3-aikido.10
5.18.3-aikido.105.18.3-aikido.115.18.3-aikido.12
org.apache.activemq:activemq-openwire-legacy
Root:Maven
 before 5.18.3-aikido.10
5.18.3-aikido.105.18.3-aikido.115.18.3-aikido.12
activemq
Ubuntu:Pro:16.04:LTS
 before 5.13.2+dfsg-2ubuntu0.1~esm1, plus listed versions
5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-2
5.13.2+dfsg-2ubuntu0.1~esm1
activemq
Ubuntu:Pro:18.04:LTS
 before 5.15.8-2~18.04.1~esm1, plus listed versions
5.14.5-35.15.2-25.15.3-25.15.8-2~18.04
5.15.8-2~18.04.1~esm1
activemq
Ubuntu:Pro:20.04:LTS
 before 5.15.11-1ubuntu0.1~esm1, plus listed versions
5.15.10-15.15.11-1
5.15.11-1ubuntu0.1~esm1
activemq
Ubuntu:22.04:LTS
 before 5.16.1-1ubuntu0.1, plus listed versions
5.16.1-1
5.16.1-1ubuntu0.1
activemq
Ubuntu:Pro:22.04:LTS
 before 5.16.1-1ubuntu0.1~esm1, plus listed versions
5.16.1-1
5.16.1-1ubuntu0.1~esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubtrganda/ActiveMQ-RCE2023-10-26
MetasploitApache ActiveMQ Unauthenticated Remote Code Execution2023-10-27
PoC in GitHubSaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ2023-11-03
PoC in GitHubevkl1d/CVE-2023-466042023-11-04
PoC in GitHubjustdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp2023-11-08
PoC in GitHubh3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up2023-11-09
PoC in GitHubduck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell2023-11-12
PoC in GitHubvjayant93/CVE-2023-46604-POC2023-11-15
PoC in GitHubLiritoShawshark/CVE-2023-46604_ActiveMQ_RCE_Recurrence2023-11-16
PoC in GitHubNKeshawarz/CVE-2023-46604-RCE2023-11-18
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubCrackerCat/ActiveMQ_RCE_Pro_Max2023-11-20
PoC in GitHubminhangxiaohui/ActiveMQ_CVE-2023-466042023-11-20
PoC in GitHubnitzanoligo/CVE-2023-46604-demo2023-11-20
PoC in GitHubdcm2406/CVE-Lab2023-12-07
PoC in GitHubmrpentst/CVE-2023-466042023-12-09
PoC in GitHubdcm2406/CVE-2023-466042023-12-16
PoC in GitHubMudoleto/Broker_ApacheMQ2023-12-23
PoC in GitHubtomasmussi/activemq-cve-2023-466042023-12-30
PoC in GitHubstegano5/ExploitScript-CVE-2023-466042024-02-14
PoC in GitHubArlenhiack/ActiveMQ-RCE-Exploit2024-03-05
PoC in GitHubvulncheck-oss/cve-2023-466042024-04-17
PoC in GitHubthinkycx/activemq-rce-cve-2023-466042024-04-26
PoC in GitHubmranv/honeypot.rs2024-05-29
PoC in GitHubpulentoski/CVE-2023-466042024-05-31
PoC in GitHubcuanh2333/CVE-2023-466042024-10-16
PoC in GitHubskrkcb2/CVE-2023-466042025-02-27
NucleiApache ActiveMQ - Remote Code Execution

Plus 18 more. The full list has every link.

History

History
WhenChangedSources
2026-11-03exploitation
2026-11-03exploits, exploits_more
2026-11-03exploits
2026-11-02createdCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open