← Vulnerability Intelligence

CVE-2023-46604

Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
100% (percentile: 100) as of 2 November 2026
CWE
CWE-502

Affected products

apache: activemq; apache: activemq legacy openwire module; debian: debian linux; netapp: e-series santricity unified manager; netapp: e-series santricity web services proxy; netapp: santricity storage plugin

References