CVE-2023-46604
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
- Published
- Oct 27, 2023
- Updated
- Nov 3, 2025
- Assigning CNA
- apache
- Evidence observed
- Nov 2, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Sources
activemq/CVE-2023-46604
Apache ActiveMQ OpenWire Protocol Deserialization RCE (CVE-2023-46604)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/activemq:5.17.3(activemq/CVE-2023-46604/docker-compose.yml:services.activemq.image)
modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix,Windows($.exploit_multi/misc/apache_activemq_rce_cve_2023_46604.platform)
- verification: check_declared($.exploit_multi/misc/apache_activemq_rce_cve_2023_46604.check)
javascript/cves/2023/CVE-2023-46604.yaml
Nuclei TemplatesDeclared conditions
- verification: dsl($.matchers[*].type)
- oob: interactsh_reference($.template_text)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.