CVE-2023-46604

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

At a glance

Severity: CRITICAL 10.0
Exploitation: Known exploited (CISA KEV) · added 2023-11-02
Exploited per ENISA since 2023-11-02
EPSS: EPSS 99.89 % · percentile 100 (2026-10-27)
State: PUBLISHED
Published: 2023-10-27
Updated: 2025-11-03
Assigner: apache
NVD status: Analyzed

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H	apache
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H	NVD · security@apache.org (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-502

Advisories

GHSA-crg9-44h2-xw35 — Apache ActiveMQ is vulnerable to Remote Code Execution

European references

ENISA EUVD · EUVD-2023-2719
GCVE · GCVE-0-2023-46604

CERT-FR advisories

CERTFR-2024-AVI-0646 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0228 — Multiples vulnérabilités dans IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0180 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0090 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-1062 — Multiples vulnérabilités dans Juniper Secure Analytics · cert.ssi.gouv.fr
CERTFR-2023-AVI-1055 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-0919 — Vulnérabilité dans les produits SolarWinds · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* < 5.15.16
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* ≥ 5.16.0 < 5.16.7
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* ≥ 5.17.0 < 5.17.6
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* ≥ 5.18.0 < 5.18.3
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* < 5.15.16
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* ≥ 5.16.0 < 5.16.7
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* ≥ 5.17.0 < 5.17.6
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* ≥ 5.18.0 < 5.18.3
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*

Affected products

Product	Versions
Apache Software Foundation · Apache ActiveMQ	affected 5.18.0 < 5.18.3 ; affected 5.17.0 < 5.17.6 ; affected 5.16.0 < 5.16.7 ; affected 0 < 5.15.16
Apache Software Foundation · Apache ActiveMQ Legacy OpenWire Module	affected 5.18.0 < 5.18.3 ; affected 5.17.0 < 5.17.6 ; affected 5.16.0 < 5.16.7 ; affected 5.8.0 < 5.15.16

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD