CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

CISA Known Exploited Vulnerabilities

Name

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Vendor

Apache

Product

ActiveMQ

Added to the catalog

2023-11-02

Due date for US federal agencies

2023-11-23

Weaknesses

CWE-502

Catalog version

2026.10.30

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware use: CISA marks this vulnerability as known to be used in ransomware campaigns. CISA does not say which group used it.

Links in CISA's notes

• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• https://nvd.nist.gov/vuln/detail/CVE-2023-46604

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2023-10-27T15:15:14.017

Last modified

2026-06-17T06:31:11.370

Weaknesses

CWE-502

The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.

Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.

References

• http://seclists.org/fulldisclosure/2024/Apr/18 (Mailing List, Third Party Advisory)
• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt (Vendor Advisory)
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html (Mailing List)
• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html (Exploit, Third Party Advisory, VDB Entry)
• https://security.netapp.com/advisory/ntap-20231110-0010/ (Third Party Advisory)
• https://www.openwall.com/lists/oss-security/2023/10/27/5 (Mailing List)
• http://seclists.org/fulldisclosure/2024/Apr/18 (Mailing List, Third Party Advisory)
• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt (Vendor Advisory)
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html (Mailing List)
• https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html (Mailing List)
• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html (Exploit, Third Party Advisory, VDB Entry)
• https://security.netapp.com/advisory/ntap-20231110-0010/ (Third Party Advisory)
• https://www.openwall.com/lists/oss-security/2023/10/27/5 (Mailing List)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 (Third Party Advisory, US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:08.214Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-46604

CVE record

Title (CNA)

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

Assigner

apache

State

PUBLISHED

Published

2023-10-27T14:59:31.046Z

Updated

2025-11-03T21:50:00.516Z

Problem types

CWE-502 Deserialization of Untrusted Data

The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.

Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.

References

• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• https://www.openwall.com/lists/oss-security/2023/10/27/5
• https://security.netapp.com/advisory/ntap-20231110-0010/
• https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
• http://seclists.org/fulldisclosure/2024/Apr/18

Read on 2026-11-03T02:04:52.326Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json

GitHub Advisory Database

Also known as / affected packages

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/