UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46604

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 2 Nov 2023.

Severity
Critical 9.8
Published
27 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.15.16, 5.16.7, 5.17.6, 5.18.3
Sources
NVD

Affected software

SoftwareAffected versions
Apache ActiveMQServers and applications · cpe:a:apache:activemq
  • Every version before 5.15.16
  • From 5.16.0 before 5.16.7
  • From 5.17.0 before 5.17.6
  • From 5.18.0 before 5.18.3

Known exploited

CISA name
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
23 Nov 2023
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46604
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46604