{"id":"CVE-2016-3088","published":"2016-06-01T20:59:04Z","modified":"2026-06-17T00:44:56Z","title":"Apache ActiveMQ Improper Input Validation Vulnerability","vendor":"Apache","product":"ActiveMQ","tier":"core","eol":null,"description":{"text":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper input validation issue in the Fileserver web application of Apache ActiveMQ 5.x releases before 5.14.0. An attacker with network access to that web application needs no authentication or user interaction: by sending an HTTP PUT followed by an HTTP MOVE request, they can upload files and execute arbitrary ones.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:01:00Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98518,"percentile":0.99921,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3088","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-09-19","exploitedFirstSeen":"2018-09-19","ransomware":true,"evidence":[{"url":"https://www.tenable.com/blog/xbash-malware-targets-windows-and-linux-with-ransomware-and-cryptomining","date":"2018-09-19"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-02-10"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2016-3088","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2016-3088","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2016-3088","date":"2023-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2016-3088","date":"2023-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2016-3088","date":"2023-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2016-3088","date":"2023-11-22"}],"evidenceTotal":852,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2036.html","tags":["Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1035951","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-356","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-357","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/42283/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2036.html","tags":["Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1035951","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-356","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-357","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/42283/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: remote unauthenticated web application exploitation via HTTP","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows remote attackers to upload and execute arbitrary files","start":68,"end":129}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: uploaded files executed, yielding code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary files via an HTTP PUT","start":106,"end":145}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-47d1c126a36d01f3bea4","title":"SpeakUp: A New Undetected Backdoor Linux Trojan","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","date":"2019-02-04","mentions":[{"quote":"g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability.","start":6777,"end":6870},{"quote":"Code Execution (CVE-2018-20062)\n- Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271)\n- Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894)\n- Hadoop YARN ResourceManager Remote Command Execution\n- Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088)","start":9936,"end":10256}]},{"id":"SRC-2907f353427b017fc00d","title":"Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/","date":"2018-09-17","mentions":[{"quote":"ActiveMQ arbitrary file write vulnerability, CVE-2016-3088.","start":14165,"end":14224}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.0.0, <5.14.0"],"patched":["5.14.0"],"from":["GHSA-rxqh-fc23-gxp2"],"provenance":"source"}],"advisories":[{"id":"GHSA-rxqh-fc23-gxp2","url":"https://github.com/advisories/GHSA-rxqh-fc23-gxp2","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.0.0, <5.14.0"],"patched":["5.14.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5255","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5255","exploited":true,"exploitedSince":"2022-02-10","provenance":"source"},"exploits":[{"id":40857,"url":"https://www.exploit-db.com/exploits/40857","title":"Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution","type":"remote","platform":"windows","date":"2015-08-17","verified":true,"provenance":"source"},{"id":42283,"url":"https://www.exploit-db.com/exploits/42283","title":"ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)","type":"remote","platform":"java","date":"2017-06-29","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2015-08-17"},"pocGithub":{"count":7,"skipped":2,"earliest":"2020-07-31","earliestUrl":"https://github.com/Ma1Dong/ActiveMQ_putshell-CVE-2016-3088","repos":[{"name":"Catherines77/ActiveMQ-EXPtools","url":"https://github.com/Catherines77/ActiveMQ-EXPtools","stars":86,"created":"2026-04-20"},{"name":"YutuSec/ActiveMQ_Crack","url":"https://github.com/YutuSec/ActiveMQ_Crack","stars":18,"created":"2022-04-02"},{"name":"Ma1Dong/ActiveMQ_putshell-CVE-2016-3088","url":"https://github.com/Ma1Dong/ActiveMQ_putshell-CVE-2016-3088","stars":15,"created":"2020-07-31"},{"name":"cyberaguiar/CVE-2016-3088","url":"https://github.com/cyberaguiar/CVE-2016-3088","stars":5,"created":"2021-03-11"},{"name":"cl4ym0re/CVE-2016-3088","url":"https://github.com/cl4ym0re/CVE-2016-3088","stars":4,"created":"2021-07-03"}]},"metasploit":[{"name":"ActiveMQ web shell upload","module":"exploit/multi/http/apache_activemq_upload_jsp","type":"exploit","disclosureDate":"2016-06-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_activemq_upload_jsp.rb"}],"nuclei":[{"id":"CVE-2016-3088","name":"Apache ActiveMQ Fileserver - Arbitrary File Write","severity":"critical","path":"http/cves/2016/CVE-2016-3088.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3088.yaml"}],"first":{"date":"2015-08-17","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40857"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/42283/","https://www.exploit-db.com/exploits/42283"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"},{"stage":"related","techniques":["T1505.003"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-08-17","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-40857); later: Metasploit 2016-06-01, PoC-in-GitHub 2020-07-31","url":"https://www.exploit-db.com/exploits/40857","provenance":"source"},{"date":"2016-06-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3088","provenance":"source"},{"date":"2018-09-17","kind":"report","label":"Named in unit42.paloaltonetworks.com: Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Wind…","url":"https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/","provenance":"machine"},{"date":"2018-09-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.tenable.com/blog/xbash-malware-targets-windows-and-linux-with-ransomware-and-cryptomining","provenance":"source"},{"date":"2019-02-04","kind":"report","label":"Named in research.checkpoint.com: SpeakUp: A New Undetected Backdoor Linux Trojan","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","provenance":"machine"},{"date":"2022-02-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5255","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":2080},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2964 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 advisory exploit reference; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-activemq-cve-2015-1830","parents":[{"from":"CVE-2015-1830","to":"CVE-2016-3088","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["activemq-fileserver/src/main/java/org/apache/activemq/util/FilenameGuardFilter.java","activemq-fileserver/src/main/webapp/index.html"],"commits":["https://github.com/apache/activemq/commit/729c4731574ffffaf58ebefdbaeb3bd19ed1c7b7","https://github.com/apache/activemq/commit/9fd5cb7dfe0fcc431f99d5e14206e0090e72f36b","https://github.com/apache/activemq/commit/3dd86d04e8b90ba309819317d19e7260d414d9e7"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.4,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2015-5254","published":"2016-01-08","fixed":"5.12.2","kev":false},{"cve":"CVE-2016-0734","published":"2016-04-07","fixed":"5.13.2","kev":false,"link":{"from":"CVE-2016-0734","to":"CVE-2016-3088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-client","fromFixed":"5.13.2","toFixed":"5.14.0","daysApart":55}]}},{"cve":"CVE-2016-0782","published":"2016-08-05","fixed":"5.13.2","kev":false},{"cve":"CVE-2016-3088","published":"2016-06-01","fixed":"5.14.0","kev":true},{"cve":"CVE-2016-6810","published":"2018-01-10","fixed":"5.14.2","kev":false,"link":{"from":"CVE-2016-3088","to":"CVE-2016-6810","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-client","fromFixed":"5.14.0","toFixed":"5.14.2","daysApart":588}]}},{"cve":"CVE-2015-7559","published":"2019-08-01","fixed":"5.14.5","kev":false},{"cve":"CVE-2018-11775","published":"2018-09-10","fixed":"5.15.6","kev":false}],"package":"Maven:org.apache.activemq:activemq-client"}}