Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

Apache ActiveMQ OpenWire Remote Code Execution

Insecure deserialization vulnerability in Apache ActiveMQ OpenWire protocol implementation allowing unauthenticated remote code execution via ClassPathXmlApplicationContext invocation.

Status
Vendor Patched
Reported / Disclosed
2023

Impact

  • Instantiations of arbitrary Java classes over raw OpenWire TCP port 61616.
  • Retrieval and execution of remote XML spring bean definitions leading to OS shell.
  • High ransomware targeting and automated post-compromise lateral movement.

Timeline

  1. OCTOBER 25, 2023

    Apache Software Foundation published security advisory and patched binaries.

  2. OCTOBER 27, 2023

    Public PoC exploits released and weaponized by threat actors.

  3. NOVEMBER 2023

    CISA added CVE-2023-46604 to Known Exploited Vulnerabilities Catalog.

aura~
Back to CVEs & Disclosures