Vulnerabilities/Apache/CVE-2023-46604
CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 2 Nov 2023
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 23 Nov 2023 · CWE-502
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ActiveMQ | 5.18.0 to before 5.18.3 | Unknown |
| Apache ActiveMQ | 5.17.0 to before 5.17.6 | Unknown |
| Apache ActiveMQ | 5.16.0 to before 5.16.7 | Unknown |
| Apache ActiveMQ | before 5.15.16 | Unknown |
| Apache ActiveMQ Legacy OpenWire Module | 5.18.0 to before 5.18.3 | Unknown |
Show 3 more rows
| Apache ActiveMQ Legacy OpenWire Module | 5.17.0 to before 5.17.6 | Unknown |
| Apache ActiveMQ Legacy OpenWire Module | 5.16.0 to before 5.16.7 | Unknown |
| Apache ActiveMQ Legacy OpenWire Module | 5.8.0 to before 5.15.16 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 2 Nov 2023 · Added to CISA KEV
- 23 Nov 2023 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.