9.8

CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed
AliasesUBUNTU-CVE-2016-3088DEBIAN-CVE-2016-3088GHSA-rxqh-fc23-gxp2
Published 01-06-2016Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2016-3088 is a critical (CVSS 9.8) vulnerability in Apache ActiveMQ. It is known to be exploited: CISA lists it, first on 10-02-2022. EPSS estimates a 98.52% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
98.52%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3exploit-database, metasploit

Timeline

  1. 01-06-2016
    PublishedVulnerability first disclosed.
  2. 10-02-2022
    Added to CISA KEVApache ActiveMQ Improper Input Validation Vulnerability
  3. 10-08-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

98.52%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 98.52% on 18-09-2026

18-09-202618-10-2026
EPSS score
98.52%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
10-02-2022
Federal due date
10-08-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2016-3088

Public exploits

3 found
  • exploit-databaseremotejavaVerified

    ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)

    Maturity: weaponized

  • exploit-databaseremotewindowsVerified

    Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    ActiveMQ web shell upload

    exploit/multi/http/apache_activemq_upload_jsp

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Apache1 product
Debian1 product
  • activemq< 5.14.0+dfsg-1
Org.apache.activemq1 product
  • activemq-client≥ 5.0.0, < 5.14.0
Ubuntu1 product
  • activemqAll versions (No fix recorded)

4 vendors · 4 products

References

22 links
Show all 22 references