{"id":"CVE-2023-46604","published":"2023-10-27T15:15:14Z","modified":"2026-06-17T06:31:11Z","title":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","vendor":"Apache","product":"ActiveMQ","tier":"core","eol":null,"description":{"text":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","provenance":"source","from":"NVD"},"summary":{"text":"The Java OpenWire protocol marshaller in Apache ActiveMQ deserializes untrusted data, letting attackers reach remote code execution through manipulated serialized class types in the OpenWire protocol. An attacker with network access to a Java-based OpenWire broker or client, and no authentication or user interaction, can cause the broker or client to instantiate any class on its classpath and thereby run arbitrary shell commands.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99992,"percentile":0.99986,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-11-02","dueDate":"2023-11-23","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-02","exploitedFirstSeen":"2023-11-02","ransomware":true,"evidence":[{"url":"https://socradar.io/critical-rce-vulnerability-in-apache-activemq-is-targeted-by-hellokitty-ransomware-cve-2023-46604/","date":"2023-11-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-11-02"},{"url":"https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604","date":"2023-11-02"},{"url":"https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/","date":"2023-11-03"},{"url":"https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/","date":"2023-11-03"},{"url":"https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html","date":"2023-11-20"},{"url":"https://asec.ahnlab.com/en/59318/","date":"2023-11-27"},{"url":"https://www.fortinet.com/blog/threat-research/gotitan-botnet-exploitation-on-apache-activemq","date":"2023-11-28"},{"url":"https://blog.sekoia.io/activemq-cve-2023-46604-exploited-by-kinsing-and-overview-of-this-threat/","date":"2023-12-11"},{"url":"https://asec.ahnlab.com/en/59904/","date":"2023-12-19"}],"evidenceTotal":71,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://seclists.org/fulldisclosure/2024/Apr/18","tags":["Mailing List","Third Party Advisory"]},{"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html","tags":["Mailing List"]},{"url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010/","tags":["Third Party Advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/27/5","tags":["Mailing List"]},{"url":"http://seclists.org/fulldisclosure/2024/Apr/18","tags":["Mailing List","Third Party Advisory"]},{"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html","tags":["Mailing List"]},{"url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010/","tags":["Third Party Advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/27/5","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. ","confidence":"high"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. ","confidence":"high"},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. ","confidence":"high"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":["<5.15.16",">=5.16.0, <5.16.7",">=5.17.0, <5.17.6",">=5.18.0, <5.18.3"],"patched":["5.15.16","5.16.7","5.17.6","5.18.3"],"from":["GHSA-crg9-44h2-xw35"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","vulnerableRanges":[">=5.8.0, <5.15.16",">=5.16.0, <5.16.7",">=5.17.0, <5.17.6",">=5.18.0, <5.18.3"],"patched":["5.15.16","5.16.7","5.17.6","5.18.3"],"from":["GHSA-crg9-44h2-xw35"],"provenance":"source"}],"advisories":[{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":["<5.15.16"],"patched":["5.15.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.16.0, <5.16.7"],"patched":["5.16.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.17.0, <5.17.6"],"patched":["5.17.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.18.0, <5.18.3"],"patched":["5.18.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","vulnerableRanges":[">=5.8.0, <5.15.16"],"patched":["5.15.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","vulnerableRanges":[">=5.16.0, <5.16.7"],"patched":["5.16.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","vulnerableRanges":[">=5.17.0, <5.17.6"],"patched":["5.17.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-crg9-44h2-xw35","url":"https://github.com/advisories/GHSA-crg9-44h2-xw35","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.activemq:activemq-openwire-legacy","vulnerableRanges":[">=5.18.0, <5.18.3"],"patched":["5.18.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2719","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2719","exploited":true,"exploitedSince":"2023-11-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":35,"skipped":8,"earliest":"2023-10-26","earliestUrl":"https://github.com/trganda/ActiveMQ-RCE","repos":[{"name":"SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ","url":"https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ","stars":126,"created":"2023-11-03"},{"name":"Catherines77/ActiveMQ-EXPtools","url":"https://github.com/Catherines77/ActiveMQ-EXPtools","stars":86,"created":"2026-04-20"},{"name":"Arlenhiack/ActiveMQ-RCE-Exploit","url":"https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit","stars":44,"created":"2024-03-05"},{"name":"evkl1d/CVE-2023-46604","url":"https://github.com/evkl1d/CVE-2023-46604","stars":41,"created":"2023-11-04"},{"name":"trganda/ActiveMQ-RCE","url":"https://github.com/trganda/ActiveMQ-RCE","stars":28,"created":"2023-10-26"}]},"metasploit":[{"name":"Apache ActiveMQ Unauthenticated Remote Code Execution","module":"exploit/multi/misc/apache_activemq_rce_cve_2023_46604","type":"exploit","disclosureDate":"2023-10-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb"}],"nuclei":[{"id":"CVE-2023-46604","name":"Apache ActiveMQ - Remote Code Execution","severity":"critical","path":"javascript/cves/2023/CVE-2023-46604.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml"}],"first":{"date":"2023-10-26","source":"PoC-in-GitHub","url":"https://github.com/trganda/ActiveMQ-RCE"},"provenance":"source"},"exploitRefs":["https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059.004"],"provenance":"source"},{"stage":"secondary","techniques":["T1053.005"],"provenance":"source"}],"timeline":[{"date":"2023-10-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2023-10-27","url":"https://github.com/trganda/ActiveMQ-RCE","provenance":"source"},{"date":"2023-10-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46604","provenance":"source"},{"date":"2023-11-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://socradar.io/critical-rce-vulnerability-in-apache-activemq-is-targeted-by-hellokitty-ransomware-cve-2023-46604/","provenance":"source"},{"date":"2023-11-02","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-11-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2719","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":6},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1094 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 advisory exploit reference; 35 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2015-7559","published":"2019-08-01","fixed":"5.14.5","kev":false},{"cve":"CVE-2018-11775","published":"2018-09-10","fixed":"5.15.6","kev":false},{"cve":"CVE-2019-0222","published":"2019-03-28","fixed":"5.15.9","kev":false},{"cve":"CVE-2023-46604","published":"2023-10-27","fixed":"5.18.3","kev":true},{"cve":"CVE-2025-27533","published":"2025-05-07","fixed":"6.1.6","kev":false,"link":{"from":"CVE-2023-46604","to":"CVE-2025-27533","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-client","fromFixed":"5.16.7","toFixed":"5.16.8","daysApart":558},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-openwire-legacy","fromFixed":"5.16.7","toFixed":"5.16.8","daysApart":558}]}},{"cve":"CVE-2026-33227","published":"2026-04-07","fixed":"6.2.2","kev":false},{"cve":"CVE-2026-39304","published":"2026-04-10","fixed":"6.2.4","kev":false}],"package":"Maven:org.apache.activemq:activemq-client"}}