CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

10.0 CRITICALEPSS 99.99%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 06:31 UTC

OverviewCVSS details

10.0CRITICALCVSS 3.1

Score source: apache (CNA)
NVD status: Analyzed
Published: Oct 27, 2023
Assigner: apache

Affected

Apache ActiveMQ (Apache Software Foundation)

Versions: 5.18.0 before 5.18.3 · 5.17.0 before 5.17.6
Fixed in: 5.18.3, 5.17.6, 5.16.7

+1 more product →

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Nov 2, 2023
KEV due date: Nov 23, 2023
Ransomware use: Known
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

99.99%chance of exploitation in 30 days

Higher than 99.98% of CVEs

CVSS 3.1 · apache (CNA)

10.0Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality impact: Low
Integrity impact: High
Availability impact: High

CVSS 3.1 · NVD

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
10.0	CRITICAL	3.1apache (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Nov 23, 2023

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2023-46604
Status: Analyzed
Assigner (CNA): apache
Published: Oct 27, 2023
Last modified: 2026-06-17 06:31 UTC
Weaknesses: CWE-502 · Deserialization of Untrusted Data

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 14:02 UTC.