10

CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

CVSS: 10.0v3.1CriticalKEVRansomwareAnalyzed
AliasesUBUNTU-CVE-2023-46604DEBIAN-CVE-2023-46604GHSA-crg9-44h2-xw35
Published 27-10-2023Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2023-46604 is a critical (CVSS 10.0) Deserialization of Untrusted Data vulnerability in Apache ActiveMQ. It is known to be exploited: CISA and ENISA list it, first on 02-11-2023. It has been used in ransomware campaigns. EPSS estimates a 99.89% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
100/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
99.89%
0%100%
Critical · +0.17 pp in 30 days
KEVListedCISA · ENISA
RansomwareKnown useFlagged by CISA, ENISA
Public exploits2reference, metasploit

Advisory lineage

Upstream 0 · Downstream 5 · Related 2
DLA-3657-1DLA-3936-1DSA-5798-1USN-6910-1USN-7268-1

Timeline

  1. 27-10-2023
    PublishedVulnerability first disclosed.
  2. 02-11-2023
    Added to CISA KEVApache ActiveMQ Deserialization of Untrusted Data Vulnerability
  3. 23-11-2023
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 23-01-2025
    Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.
  5. 03-11-2025
    Last modifiedVulnerability information updated.

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

99.89%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.17 pp

From 99.72% on 18-09-2026

18-09-202618-10-2026
EPSS score
99.89%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
02-11-2023
Federal due date
23-11-2023
Ransomware
ENISA CNWListed
Added
23-01-2025
Ransomware

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt nvd.nist.gov/vuln/detail/CVE-2023-46604

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • MetasploitMetasploitremoteVerified

    Apache ActiveMQ Unauthenticated Remote Code Execution

    exploit/multi/misc/apache_activemq_rce_cve_2023_46604

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Netapp3 products
Apache2 products
  • activemq< 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3
  • activemq_legacy_openwire_module< 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3
Apache software foundation2 products
Debian2 products
  • activemq< 5.17.2+dfsg-2+deb12u1 | < 5.17.6+dfsg-1
  • debian_linuxEOL10.0 | 11.0
Org.apache.activemq2 products
  • activemq-client< 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3
  • activemq-openwire-legacy≥ 5.8.0, < 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3
Ubuntu1 product
  • activemq< 5.13.2+dfsg-2ubuntu0.1~esm1 | < 5.15.8-2~18.04.1~esm1 | < 5.15.11-1ubuntu0.1~esm1 | < 5.16.1-1ubuntu0.1 | < 5.16.1-1ubuntu0.1~esm1

6 vendors · 12 products

References

27 links
Show all 27 references