Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run ActiveMQ, fix it now.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
US federal civilian agencies must remediate by Nov 23, 2023.
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
| Product | Vendor | Affected versions | Fixed in | Source |
|---|---|---|---|---|
| ActiveMQ | Apache Software Foundation | < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3 | 5.15.16; 5.16.7; 5.17.6; 5.18.3 | KEV |
Sources: KEV = CISA Known Exploited Vulnerabilities catalog.
Developments from the last 30 days, newest first.
CVE-2023-46604 scored CVSS 9.8: Apache ActiveMQ, Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched ActiveMQ systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
1 earlier event is available with a subscription. See plans.
CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched ActiveMQ systems are exposed to active attacks now.
Treat this as an emergency.
