CVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability - [Actively Exploited]
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
INFO
Published Date :
Oct. 27, 2023, 3:15 p.m.
Last Modified :
Nov. 4, 2025, 4:41 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Detected Nov 02, 2023
https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604
Affected Products
The following products are affected by CVE-2023-46604
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Upgrade Apache ActiveMQ to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 or later.
- Upgrade the activemq packages.
Public PoC/Exploit Available at Github
CVE-2023-46604 has a 106 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-46604.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-46604 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-46604
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2026-34197 — Apache ActiveMQ RCE via Jolokia API | PoC Exploit
Python
CVE-2026-34197 - Apache ActiveMQ RCE via Jolokia Endpoint PoC
Python
ovogogogo！！！！！
JavaScript TypeScript Shell
Download MITRE ATT&CK and map details from attacks into a MITRE focused format using opencode
Python Shell
Download MITRE ATT&CK and map details from attacks into a MITRE focused format using opencode
Python Shell
None
Makefile HTML Go
Personal tool to turn sequential text notes into a simple visual timeline
dfir security timeline
HTML JavaScript CSS
Apache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon kuralları ve IOC listesi.
activemq cybersecurity dfir threat-hunting
HTML
CVE-2023-46604 investigation
Dockerfile Shell
TeamCyberOps Suite v5.0.5+ Enter Target. Everything Runs Automatically. TeamCyberOps Logo Typing Header Professional Offensive Security & Advanced Reconnaissance Platform
Python Shell Dockerfile NewLisp
Apache ActiveMQ OpenWire 역직렬화 RCE 취약점 기술 분석
Docker-based CVE lab environments with PoC exploits. Log4Shell, Spring4Shell, Dirty Pipe, PwnKit, XZ backdoor and more.
ctf cve docker exploit log4shell pentest poc security spring4shell vulnerability
Python Shell Dockerfile PHP C
None
Shell
Backend server for inference and RAG supporting RHEL Command Line Assistant
Dockerfile Python
None
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-46604 vulnerability anywhere in the article.
-
Help Net Security
Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197)
In the latest demonstration of how AI assistants can help with bug hunting, Horizon3.ai researcher Naveen Sunkavally used Claude to unearth CVE-2026-34197, a remote code execution vulnerability in Apa ... Read more
-
CybersecurityNews
Claude Uncovers 13-Year-Old RCE Flaw in Apache ActiveMQ in Just 10 Minutes
A critical remote code execution (RCE) vulnerability has been disclosed in Apache ActiveMQ Classic, a flaw that sat undetected for over a decade and was ultimately discovered not by a human researcher ... Read more
-
The Hacker News
Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign
An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet. "A purpose ... Read more
-
The Hacker News
ThreatsDay Bulletin: Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories
Nothing here looks dramatic at first glance. That’s the point. Many of this week’s threats begin with something ordinary, like an ad, a meeting invite, or a software update.Behind the scenes, the tact ... Read more
-
CybersecurityNews
Threat Actors Exploit Apache ActiveMQ Server Vulnerability to Gain RDP Access and Deploy LockBit Ransomware
A critical vulnerability in Apache ActiveMQ has been actively exploited by threat actors, leading to a full LockBit ransomware deployment across an enterprise network. Attackers leveraged CVE-2023-466 ... Read more
-
Daily CyberSecurity
Unpatched ActiveMQ Flaw Leads to Repeat Breach and LockBit Ransomware
In the world of cybersecurity, “eviction” is rarely the end of the story. A new case study from The DFIR Report reveals how a persistent threat actor exploited a critical vulnerability in Apache Activ ... Read more
-
Daily CyberSecurity
Kinsing Cryptominer Exploits Apache ActiveMQ RCE (CVE-2023-46604), Adds Sharpire Backdoor for Multi-Stage Intrusion
The AhnLab Security Intelligence Center (ASEC) has confirmed that the Kinsing threat actor — also known as H2Miner — continues to actively exploit known vulnerabilities, particularly CVE-2023-46604 in ... Read more
-
The Cyber Express
22 Vulnerabilities Under Attack – And Another That Could Be
Cyble researchers detailed 22 vulnerabilities under active attack in a blog post today – and nine of them aren’t in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Twelve of the vulnerabilities ... Read more
-
Daily CyberSecurity
25W Wireless Charging Arrives: Qi 2.2 Ushers in a New Era of Fast Power
The Wireless Power Consortium (WPC) has officially introduced the Qi 2.2 wireless charging standard, offering devices with full protocol support a maximum charging power of 25W—a substantial leap that ... Read more
-
Daily CyberSecurity
How Attackers Exploit and Then Patch a Vulnerability to Hide in Linux Systems
Red Canary has revealed a sophisticated attack campaign targeting cloud-based Linux systems through a critical remote code execution flaw in Apache ActiveMQ (CVE-2023-46604). The campaign showcases ho ... Read more
-
Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto
New DripDropper Malware Exploits Linux Flaw Then Patches It Lock Rivals Out
A new report from Red Canary reveals a clever Linux malware called DripDropper that exploits a flaw and then patches it to prevent other hackers from getting in. Learn how this tactic works. A new rep ... Read more
-
CybersecurityNews
Hackers Exploiting Apache ActiveMQ Vulnerability to Gain Access to Cloud Linux Systems
A sophisticated campaign uncovered where adversaries are exploiting CVE-2023-46604, a critical remote code execution vulnerability in Apache ActiveMQ, to compromise cloud-based Linux systems. In this ... Read more
-
CybersecurityNews
Paper Werewolf Exploiting WinRAR Zero‑Day Vulnerability to Deliver Malware
Cybersecurity researchers have uncovered a sophisticated campaign by the Paper Werewolf threat actor group, also known as GOFFEE, targeting Russian organizations through the exploitation of critical v ... Read more
-
security.nl
Aanvallers patchen Apache ActiveMQ-lek na compromitteren van server
Aanvallers maken misbruik van een kritieke kwetsbaarheid in Apache ActiveMQ om Linux-servers te compromitteren en patchen het lek zodra ze binnen zijn. Dat stelt securitybedrijf Red Canary in een anal ... Read more
-
The Register
Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in
Criminals exploiting a critical vulnerability in open source Apache ActiveMQ middleware are fixing the flaw that allowed them access, after establishing persistence on Linux servers. Researchers at se ... Read more
-
The Hacker News
Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems
Aug 19, 2025Ravie LakshmananLinux / Malware Threat actors are exploiting a nearly two-year-old security flaw in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy malware ca ... Read more
-
Red Canary
Patching for persistence: How DripDropper Linux malware moves through the cloud
It may seem counterintuitive for an adversary to “fix” a compromised system after gaining remote access but in many scenarios the motivation can be twofold. It’s a great way to potentially lock out ot ... Read more
-
CybersecurityNews
H2Miner Attacking Linux, Windows, and Containers to Mine Monero
The H2Miner botnet, first observed in late 2019, has resurfaced with an expanded arsenal that blurs the line between cryptojacking and ransomware. The latest campaign leverages inexpensive virtual pri ... Read more
-
The Register
Oracle emits 603 patches, names one it wants you to worry about soon
Oracle has delivered its regular quarterly collection of patches: 603 in total, 318 for its own products, and another 285 for Linux code it ships. Big Red’s VP of security assurance Eric Maurice singl ... Read more
-
The Hacker News
Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products
Vulnerability / Enterprise Security Oracle is urging customers to apply its January 2025 Critical Patch Update (CPU) to address 318 new security vulnerabilities spanning its products and services. The ... Read more
The following table lists the changes that have been made to the
CVE-2023-46604 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Nov. 04, 2025
Action Type Old Value New Value Changed CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html Types: Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html -
Modified Analysis by [email protected]
Oct. 23, 2025
Action Type Old Value New Value Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 Types: Third Party Advisory, US Government Resource -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 21, 2025
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 21, 2025
Action Type Old Value New Value Removed Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 21, 2025
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 -
Modified Analysis by [email protected]
Mar. 07, 2025
Action Type Old Value New Value -
CVE Modified by [email protected]
Feb. 13, 2025
Action Type Old Value New Value Changed Description The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. -
Modified Analysis by [email protected]
Jan. 23, 2025
Action Type Old Value New Value Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference http://seclists.org/fulldisclosure/2024/Apr/18 Added Reference https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Added Reference https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Added Reference https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Added Reference https://security.netapp.com/advisory/ntap-20231110-0010/ Added Reference https://www.openwall.com/lists/oss-security/2023/10/27/5 -
Modified Analysis by [email protected]
Jun. 27, 2024
Action Type Old Value New Value Changed Reference Type http://seclists.org/fulldisclosure/2024/Apr/18 No Types Assigned http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List, Third Party Advisory Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory Changed Reference Type https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html No Types Assigned https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry Changed Reference Type https://security.netapp.com/advisory/ntap-20231110-0010/ No Types Assigned https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory Changed Reference Type https://www.openwall.com/lists/oss-security/2023/10/27/5 No Types Assigned https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:* -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by [email protected]
Apr. 11, 2024
Action Type Old Value New Value Added Reference Apache Software Foundation http://seclists.org/fulldisclosure/2024/Apr/18 [No types assigned] -
CVE Modified by [email protected]
Nov. 28, 2023
Action Type Old Value New Value Added Reference Apache Software Foundation https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html [No types assigned] Removed Reference Apache Software Foundation http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html -
CVE Modified by [email protected]
Nov. 20, 2023
Action Type Old Value New Value Added Reference Apache Software Foundation https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html [No types assigned] -
CVE Modified by [email protected]
Nov. 14, 2023
Action Type Old Value New Value Added Reference Apache Software Foundation http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html [No types assigned] -
CVE Modified by [email protected]
Nov. 11, 2023
Action Type Old Value New Value Changed Description Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. Added Reference Apache Software Foundation https://www.openwall.com/lists/oss-security/2023/10/27/5 [No types assigned] Removed Reference Apache Software Foundation http://www.openwall.com/lists/oss-security/2023/10/27/5 -
CVE Modified by [email protected]
Nov. 10, 2023
Action Type Old Value New Value Added Reference Apache Software Foundation https://security.netapp.com/advisory/ntap-20231110-0010/ [No types assigned] -
Initial Analysis by [email protected]
Nov. 08, 2023
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/27/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List, Third Party Advisory Changed Reference Type https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt No Types Assigned https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory Added CPE Configuration OR *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.16 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.16.0 up to (excluding) 5.16.7 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.17.0 up to (excluding) 5.17.6 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.18.0 up to (excluding) 5.18.3 Added CPE Configuration OR *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.16 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.16.0 up to (excluding) 5.16.7 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.17.0 up to (excluding) 5.17.6 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.18.0 up to (excluding) 5.18.3 -
CVE Modified by [email protected]
Oct. 27, 2023
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2023/10/27/5 [No Types Assigned]