Skip to content
Fencer Vulns
critical 10.0

CVE-2023-46604 kev+ ransomware in the critical feed json

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

published 2023-10-27 3 y ago modified 2026-09-08 2 mo ago also BIT-activemq-2023-46604 , EUVD-2023-2719 , GHSA-crg9-44h2-xw35

cvss
10.0
version 3.1, CNA
cisa kev
Exploited
added 2023-11-02, used in ransomware
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit, plus a Nuclei check

Summary

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.

Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • maven org.apache.activemq:activemq-client 5.15.16, 5.16.7, 5.17.6, 5.18.3
  • maven org.apache.activemq:activemq-openwire-legacy 5.15.16, 5.16.7, 5.17.6, 5.18.3
  • bitnami activemq 5.15.16, 5.16.7, 5.17.6, 5.18.3
  • Apache Software Foundation Apache ActiveMQ 5.15.16, 5.16.7, 5.17.6, 5.18.3
  • Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module 5.15.16, 5.16.7, 5.17.6, 5.18.3
  • activemq Debian 12 5.17.2+dfsg-2+deb12u1
  • activemq Debian 13 5.17.6+dfsg-1

debian advisories DEBIAN-CVE-2023-46604

  • activemq Ubuntu 22.04 LTS 5.16.1-1ubuntu0.1
  • activemq Ubuntu Pro 16.04 LTS 5.13.2+dfsg-2ubuntu0.1~esm1
  • activemq Ubuntu Pro 18.04 LTS 5.15.8-2~18.04.1~esm1
  • activemq Ubuntu Pro 20.04 LTS 5.15.11-1ubuntu0.1~esm1
  • activemq Ubuntu Pro 22.04 LTS 5.16.1-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2023-46604

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-46604 updated cvss 9.8

activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

  • Red Hat JBoss Fuse Service Works 6 activemq-openwire activemq-openwire
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat AMQ 6.3 openshift container image
    fixed: vendor fix RHSA-2023:6877
  • Red Hat AMQ Broker 7.10.5
    fixed: vendor fix RHSA-2023:6878
  • Red Hat AMQ Broker 7.11.4
    fixed: vendor fix RHSA-2023:6879
  • Red Hat Middleware RHEL 7 Containers for OpenShift jboss-amq-6/amq63-openshift 1.4-50
    fixed: vendor fix RHSA-2023:6866
  • Red Hat Fuse 7.12.1
    fixed: vendor fix RHSA-2023:7247
  • Red Hat Fuse/AMQ 6.3.20
    fixed: vendor fix RHSA-2023:6849

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-274-01 updated cvss 9.8

Armatura LLC Armatura One

  • Armatura LLC Armatura One <4.7.2 Armatura LLC Armatura One (USA) <4.6.1
    affected: vendor fix, mitigation “For more information see the associated CISA security advisory ICSA-26-274-01 JSON.” raw.githubusercontent.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-25-044-14 updated cvss 9.6

Siemens Opcenter Intelligence

  • Siemens Opcenter Intelligence <V2501
    affected: fixed in V2501

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-130-03 updated cvss 9.8

Delta Electronics InfraSuite Device Master

  • Delta Electronics InfraSuite Device Master <=1.0.10
    affected: mitigation “Delta Electronics states that this issue was fixed by version 1.0.11 released in December 2023. Delta recommends updating to version 1.0.11 or later.” datacenter-softwarecenter.deltaww.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/misc/apache_activemq_rce_cve_2023_46604)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-11-23 (2 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
Apache, ActiveMQ
CISA name
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • RansomHub ransomware gang

reported by cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1059.004 Unix Shell primary impact
  • T1053.005 Scheduled Task secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

99.99% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
GitHub 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.activemq:activemq-client
<5.15.16
>=5.16.0, <5.16.7
>=5.17.0, <5.17.6
>=5.18.0, <5.18.3
5.15.16
5.16.7
5.17.6
5.18.3
maven org.apache.activemq:activemq-openwire-legacy
>=5.8.0, <5.15.16
>=5.16.0, <5.16.7
>=5.17.0, <5.17.6
>=5.18.0, <5.18.3
5.15.16
5.16.7
5.17.6
5.18.3
bitnami activemq
<5.15.16
>=5.16.0, <5.16.7
>=5.17.0, <5.17.6
>=5.18.0, <5.18.3
5.15.16
5.16.7
5.17.6
5.18.3

Affected products

  • Apache Software Foundation Apache ActiveMQ
  • Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.