Skip to content
Fencer Vulns
critical 9.8

CVE-2023-33246 kev in the critical feed json

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

published 2023-05-24 3 y ago modified 2026-06-17 4 mo ago also GHSA-x3cq-8f32-5f63 , EUVD-2023-2175

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2023-09-06
epss
96.6%
EPSS 96.6% chance of exploitation in 30 days, percentile 99.8%
public exploits
2
Metasploit, plus a Nuclei check

Summary

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.

Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.

To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • maven org.apache.rocketmq:rocketmq-broker 5.1.1
  • maven org.apache.rocketmq:rocketmq-namesrv 4.9.6, 5.1.1
  • maven org.apache.rocketmq:rocketmq-controller 5.1.1
  • apache rocketmq 4.9.6, 5.1.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-33246 updated cvss 9.8

rocketmq: Apache RocketMQ Arbitrary Code Injection

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/apache_rocketmq_update_config)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-09-27 (3 y ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
Apache, RocketMQ
CISA name
Apache RocketMQ Command Execution Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1059 Command and Scripting Interpreter primary impact
  • T1608.001 Upload Malware secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

96.57% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

ecosystem package affected fixed in
maven org.apache.rocketmq:rocketmq-broker
>=5.0.0, <5.1.1
5.1.1
maven org.apache.rocketmq:rocketmq-namesrv
>=4.0.0, <4.9.6
>=5.0.0, <5.1.1
4.9.6
5.1.1
maven org.apache.rocketmq:rocketmq-controller
>=5.0.0, <5.1.1
5.1.1

Affected products

  • Apache Software Foundation Apache RocketMQ

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.