{"id":"CVE-2023-46604","aliases":["BIT-activemq-2023-46604","DEBIAN-CVE-2023-46604","DLA-3657-1","DLA-3936-1","DSA-5798-1","EUVD-2023-2719","GHSA-crg9-44h2-xw35","OESA-2023-1778","ROOT-APP-MAVEN-CVE-2023-46604","UBUNTU-CVE-2023-46604","USN-6910-1","USN-7268-1"],"status":"published","title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.99992,"percentile":0.99986,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2023-10-27T14:59:31Z","modified":"2026-10-28T02:30:25Z","kev":{"date_added":"2023-11-02","due_date":"2023-11-23","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2023-11-02"},{"source":"kev","since":"2023-11-02"}],"exploits":[{"source":"pocgithub","id":"trganda/ActiveMQ-RCE","title":"trganda/ActiveMQ-RCE","date":"2023-10-26","url":"https://github.com/trganda/ActiveMQ-RCE"},{"source":"metasploit","id":"exploit/multi/misc/apache_activemq_rce_cve_2023_46604","title":"Apache ActiveMQ Unauthenticated Remote Code Execution","type":"exploit","platform":"Linux,Unix,Windows","date":"2023-10-27","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/misc/apache_activemq_rce_cve_2023_46604"},{"source":"pocgithub","id":"SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ","title":"SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ","date":"2023-11-03","url":"https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ"},{"source":"pocgithub","id":"evkl1d/CVE-2023-46604","title":"evkl1d/CVE-2023-46604","date":"2023-11-04","url":"https://github.com/evkl1d/CVE-2023-46604"},{"source":"pocgithub","id":"justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp","title":"justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp","date":"2023-11-08","url":"https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp"},{"source":"pocgithub","id":"h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up","title":"h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up","date":"2023-11-09","url":"https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up"},{"source":"pocgithub","id":"duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell","title":"duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell","date":"2023-11-12","url":"https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell"},{"source":"pocgithub","id":"vjayant93/CVE-2023-46604-POC","title":"vjayant93/CVE-2023-46604-POC","date":"2023-11-15","url":"https://github.com/vjayant93/CVE-2023-46604-POC"},{"source":"pocgithub","id":"LiritoShawshark/CVE-2023-46604_ActiveMQ_RCE_Recurrence","title":"LiritoShawshark/CVE-2023-46604_ActiveMQ_RCE_Recurrence","date":"2023-11-16","url":"https://github.com/LiritoShawshark/CVE-2023-46604_ActiveMQ_RCE_Recurrence"},{"source":"pocgithub","id":"NKeshawarz/CVE-2023-46604-RCE","title":"NKeshawarz/CVE-2023-46604-RCE","date":"2023-11-18","url":"https://github.com/NKeshawarz/CVE-2023-46604-RCE"},{"source":"pocgithub","id":"CrackerCat/ActiveMQ_RCE_Pro_Max","title":"CrackerCat/ActiveMQ_RCE_Pro_Max","date":"2023-11-20","url":"https://github.com/CrackerCat/ActiveMQ_RCE_Pro_Max"},{"source":"pocgithub","id":"minhangxiaohui/ActiveMQ_CVE-2023-46604","title":"minhangxiaohui/ActiveMQ_CVE-2023-46604","date":"2023-11-20","url":"https://github.com/minhangxiaohui/ActiveMQ_CVE-2023-46604"},{"source":"pocgithub","id":"nitzanoligo/CVE-2023-46604-demo","title":"nitzanoligo/CVE-2023-46604-demo","date":"2023-11-20","url":"https://github.com/nitzanoligo/CVE-2023-46604-demo"},{"source":"pocgithub","id":"dcm2406/CVE-Lab","title":"dcm2406/CVE-Lab","date":"2023-12-07","url":"https://github.com/dcm2406/CVE-Lab"},{"source":"pocgithub","id":"mrpentst/CVE-2023-46604","title":"mrpentst/CVE-2023-46604","date":"2023-12-09","url":"https://github.com/mrpentst/CVE-2023-46604"},{"source":"pocgithub","id":"dcm2406/CVE-2023-46604","title":"dcm2406/CVE-2023-46604","date":"2023-12-16","url":"https://github.com/dcm2406/CVE-2023-46604"},{"source":"pocgithub","id":"Mudoleto/Broker_ApacheMQ","title":"Mudoleto/Broker_ApacheMQ","date":"2023-12-23","url":"https://github.com/Mudoleto/Broker_ApacheMQ"},{"source":"pocgithub","id":"tomasmussi/activemq-cve-2023-46604","title":"tomasmussi/activemq-cve-2023-46604","date":"2023-12-30","url":"https://github.com/tomasmussi/activemq-cve-2023-46604"},{"source":"pocgithub","id":"stegano5/ExploitScript-CVE-2023-46604","title":"stegano5/ExploitScript-CVE-2023-46604","date":"2024-02-14","url":"https://github.com/stegano5/ExploitScript-CVE-2023-46604"},{"source":"pocgithub","id":"Arlenhiack/ActiveMQ-RCE-Exploit","title":"Arlenhiack/ActiveMQ-RCE-Exploit","date":"2024-03-05","url":"https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit"},{"source":"pocgithub","id":"vulncheck-oss/cve-2023-46604","title":"vulncheck-oss/cve-2023-46604","date":"2024-04-17","url":"https://github.com/vulncheck-oss/cve-2023-46604"},{"source":"pocgithub","id":"thinkycx/activemq-rce-cve-2023-46604","title":"thinkycx/activemq-rce-cve-2023-46604","date":"2024-04-26","url":"https://github.com/thinkycx/activemq-rce-cve-2023-46604"},{"source":"pocgithub","id":"mranv/honeypot.rs","title":"mranv/honeypot.rs","date":"2024-05-29","url":"https://github.com/mranv/honeypot.rs"},{"source":"pocgithub","id":"pulentoski/CVE-2023-46604","title":"pulentoski/CVE-2023-46604","date":"2024-05-31","url":"https://github.com/pulentoski/CVE-2023-46604"},{"source":"pocgithub","id":"cuanh2333/CVE-2023-46604","title":"cuanh2333/CVE-2023-46604","date":"2024-10-16","url":"https://github.com/cuanh2333/CVE-2023-46604"},{"source":"pocgithub","id":"skrkcb2/CVE-2023-46604","title":"skrkcb2/CVE-2023-46604","date":"2025-02-27","url":"https://github.com/skrkcb2/CVE-2023-46604"},{"source":"nuclei","id":"CVE-2023-46604","title":"Apache ActiveMQ - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml"}],"exploits_more":18,"fixes":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","fixed_in":["5.15.16","5.16.7","5.17.6","5.18.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","fixed_in":["5.15.16","5.16.7","5.17.6","5.18.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"activemq","fixed_in":["5.15.16","5.16.7","5.17.6","5.18.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"activemq","fixed_in":["5.17.2+dfsg-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"activemq","fixed_in":["5.17.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"activemq","fixed_in":["5.15.16-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"activemq","fixed_in":["5.15.16-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"activemq","fixed_in":["5.15.16-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"activemq","fixed_in":["5.15.16-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"activemq","fixed_in":["5.15.16-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:activemq-client","fixed_in":["5.18.3-root.io.2","5.18.3-root.io.3","5.18.3-root.io.7","5.18.3-root.io.8","5.18.3-root.io.9","5.18.3-root.io.10","5.18.3-root.io.11","5.18.3-root.io.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:activemq-openwire-legacy","fixed_in":["5.18.3-root.io.4","5.18.3-root.io.8","5.18.3-root.io.9","5.18.3-root.io.10","5.18.3-root.io.11","5.18.3-root.io.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.activemq:activemq-client","fixed_in":["5.18.3-aikido.10","5.18.3-aikido.11","5.18.3-aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.activemq:activemq-openwire-legacy","fixed_in":["5.18.3-aikido.10","5.18.3-aikido.11","5.18.3-aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","fixed_in":["5.13.2+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"activemq","fixed_in":["5.15.8-2~18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"activemq","fixed_in":["5.15.11-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"activemq","fixed_in":["5.16.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"activemq","fixed_in":["5.16.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.17.0"},{"fixed":"5.17.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"5.18.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"fixed":"5.15.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.17.0"},{"fixed":"5.17.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"5.18.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"activemq","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.15.16"},{"introduced":"5.16.0"},{"fixed":"5.16.7"},{"introduced":"5.17.0"},{"fixed":"5.17.6"},{"introduced":"5.18.0"},{"fixed":"5.18.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.2+dfsg-2+deb12u1"}]}],"versions":["5.17.2+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-0+deb10u1"}]}],"versions":["5.15.10-1","5.15.11-1","5.15.8-2","5.15.9-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1+deb11u1"}]}],"versions":["5.16.1-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.2+dfsg-2+deb12u1"}]}],"versions":["5.17.2+dfsg-2"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16"}]}],"versions":["5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.14","5.15.15","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.8.0","5.9.0","5.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.7"}]}],"versions":["5.16.0","5.16.1","5.16.2","5.16.3","5.16.4","5.16.5","5.16.6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.17.0"},{"fixed":"5.17.6"}]}],"versions":["5.17.0","5.17.1","5.17.2","5.17.3","5.17.4","5.17.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"5.18.3"}]}],"versions":["5.18.0","5.18.1","5.18.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"fixed":"5.15.16"}]}],"versions":["5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.14","5.15.15","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.8.0","5.9.0","5.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.7"}]}],"versions":["5.16.0","5.16.1","5.16.2","5.16.3","5.16.4","5.16.5","5.16.6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.17.0"},{"fixed":"5.17.6"}]}],"versions":["5.17.0","5.17.1","5.17.2","5.17.3","5.17.4","5.17.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"5.18.3"}]}],"versions":["5.18.0","5.18.1","5.18.2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.3-root.io.2"},{"fixed":"5.18.3-root.io.3"},{"fixed":"5.18.3-root.io.7"},{"fixed":"5.18.3-root.io.8"},{"fixed":"5.18.3-root.io.9"},{"fixed":"5.18.3-root.io.10"},{"fixed":"5.18.3-root.io.11"},{"fixed":"5.18.3-root.io.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.3-root.io.4"},{"fixed":"5.18.3-root.io.8"},{"fixed":"5.18.3-root.io.9"},{"fixed":"5.18.3-root.io.10"},{"fixed":"5.18.3-root.io.11"},{"fixed":"5.18.3-root.io.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.3-aikido.10"},{"fixed":"5.18.3-aikido.11"},{"fixed":"5.18.3-aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.activemq:activemq-openwire-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.3-aikido.10"},{"fixed":"5.18.3-aikido.11"},{"fixed":"5.18.3-aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.2+dfsg-2ubuntu0.1~esm1"}]}],"versions":["5.6.0+dfsg1-4+deb8u1ubuntu1","5.6.0+dfsg1-5","5.13.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8-2~18.04.1~esm1"}]}],"versions":["5.14.5-3","5.15.2-2","5.15.3-2","5.15.8-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-1ubuntu0.1~esm1"}]}],"versions":["5.15.10-1","5.15.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1ubuntu0.1"}]}],"versions":["5.16.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1ubuntu0.1~esm1"}]}],"versions":["5.16.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.2+dfsg-2ubuntu0.1~esm1"}]}],"versions":["5.6.0+dfsg1-4+deb8u1ubuntu1","5.6.0+dfsg1-5","5.13.2+dfsg-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8-2~18.04.1~esm1"}]}],"versions":["5.14.5-3","5.15.2-2","5.15.3-2","5.15.8-2~18.04"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-1ubuntu0.1~esm1"}]}],"versions":["5.15.10-1","5.15.11-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1ubuntu0.1~esm1"}]}],"versions":["5.16.1-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1ubuntu0.1"}]}],"versions":["5.16.1-1"],"bundled":2}],"products":[{"vendor":"apache","product":"activemq"},{"vendor":"apache","product":"activemq_legacy_openwire_module"},{"vendor":"apache software foundation","product":"apache activemq"},{"vendor":"apache software foundation","product":"apache activemq legacy openwire module"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"e-series_santricity_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_web_services_proxy"},{"vendor":"netapp","product":"santricity_storage_plugin"}],"references":[{"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/27/5","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Apr/18","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html","tags":["Mailing List","discussion","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604","tags":["government-resource","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46604","tags":["web","advisory"]},{"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/AMQ-9370","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/27/5","tags":["web","report"]},{"url":"https://github.com/apache/activemq/pull/1098","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d","tags":["web"]},{"url":"http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f0","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010","tags":["web"]},{"url":"https://github.com/advisories/GHSA-crg9-44h2-xw35"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46604.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46604","tags":["advisory"]},{"url":"https://github.com/apache/activemq","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1778","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46604","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6910-1","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7268-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-7559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41678","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-46604","title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","status":"published","published":"2023-10-27T14:59:31.046Z","modified":"2025-11-03T21:50:00.516Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-2719","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","status":"published","published":"2023-10-27T14:59:31Z","modified":"2025-11-03T21:50:00Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"exploited_since":"2023-11-02","updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-crg9-44h2-xw35","title":"Apache ActiveMQ is vulnerable to Remote Code Execution","description":"Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \n\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.","status":"published","published":"2023-10-27T15:30:20Z","modified":"2025-11-04T00:30:41Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"kev":[{"id":"CVE-2023-46604","title":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","description":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","cwes":["CWE-502"],"kev":{"date_added":"2023-11-02","due_date":"2023-11-23","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-46604","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","status":"published","published":"2023-10-27T15:15:14.017Z","modified":"2026-06-17T06:31:11.37Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"CVE-2023-46604","title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","status":"published","published":"2023-10-27T14:59:31.046Z","modified":"2026-10-28T02:30:25.743596498Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46604","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code  Execution. This vulnerability may allow a remote attacker with network  access to either a Java-based OpenWire broker or client to run arbitrary  shell commands by manipulating serialized class types in the OpenWire  protocol to cause either the client or the broker (respectively) to  instantiate any class on the classpath.  Users are recommended to upgrade  both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3  which fixes this issue.","status":"published","published":"2023-10-27T15:15:14.017Z","modified":"2026-10-26T18:03:07.287262062Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-crg9-44h2-xw35","title":"Apache ActiveMQ is vulnerable to Remote Code Execution","description":"Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \n\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.","status":"published","published":"2023-10-27T15:30:20Z","modified":"2025-11-04T01:00:17.187812Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"OESA-2023-1778","title":"activemq security update","description":"The most popular and powerful open source messaging and Integration Patterns server.\r\n\r\nSecurity Fix(es):\r\n\r\nApache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \r\n\r\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.(CVE-2023-46604)","status":"published","published":"2023-11-03T11:06:13Z","modified":"2026-08-18T01:17:55.598034543Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2023-46604","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary  shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade  both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.","status":"published","published":"2023-10-27T15:15:00Z","modified":"2026-02-04T03:46:25.680457Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"BIT-activemq-2023-46604","title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","status":"published","published":"2025-12-03T14:35:38.733Z","modified":"2026-09-08T08:45:10.284915996Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"DLA-3657-1","title":"activemq - security update","status":"published","published":"2023-11-20T00:00:00Z","modified":"2026-03-09T01:21:05.966667Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3936-1","title":"activemq - security update","status":"published","published":"2024-10-25T00:00:00Z","modified":"2026-03-09T01:18:03.450062Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5798-1","title":"activemq - security update","status":"published","published":"2024-10-26T00:00:00Z","modified":"2026-03-09T02:09:58.548235Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-46604","title":"CVE-2023-46604 in io.root.org.apache.activemq:activemq-client - Patched by Root","description":"Root has patched CVE-2023-46604 in the io.root.org.apache.activemq:activemq-client package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-20T10:17:59Z","modified":"2026-07-20T13:15:16.91830987Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"USN-6910-1","title":"activemq vulnerabilities","description":"Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain\ncommands. A remote attacker could possibly use this issue to terminate\nthe program, resulting in a denial of service. This issue only affected\nUbuntu 16.04 LTS. (CVE-2015-7559)\n\nPeter Stöckli discovered that Apache ActiveMQ incorrectly handled\nhostname verification. A remote attacker could possibly use this issue\nto perform a person-in-the-middle attack. This issue only affected Ubuntu\n16.04 LTS. (CVE-2018-11775)\n\nJonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache\nActiveMQ incorrectly handled authentication in certain functions.\nA remote attacker could possibly use this issue to perform a\nperson-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-13920)\n\nGregor Tudan discovered that Apache ActiveMQ incorrectly handled\nLDAP authentication. A remote attacker could possibly use this issue\nto acquire unauthenticated access. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-26117)\n\nIt was discovered that Apache ActiveMQ incorrectly handled\nauthentication. A remote attacker could possibly use this issue to run\narbitrary code. (CVE-2022-41678)\n\nIt was discovered that Apache ActiveMQ incorrectly handled\ndeserialization. A remote attacker could possibly use this issue to run\narbitrary shell commands. (CVE-2023-46604)\n","status":"published","published":"2024-07-23T20:39:26Z","modified":"2026-06-25T13:32:28.776549331Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7268-1","title":"activemq vulnerabilities","description":"It was discovered that Apache ActiveMQ incorrectly handled\nauthentication. A remote attacker could possibly use this issue to run\narbitrary code. (CVE-2022-41678)\n\nIt was discovered that Apache ActiveMQ incorrectly handled\ndeserialization. A remote attacker could possibly use this issue to run\narbitrary shell commands. (CVE-2023-46604)\n","status":"published","published":"2025-02-14T10:36:08Z","modified":"2026-02-10T04:46:30Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}