Apache ActiveMQ OpenWire Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2023-46604)
Executive & SecOps Summary
SECOPS ASSESSMENTApache ActiveMQ brokers and client libraries utilizing the OpenWire protocol
Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types
Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading Apache ActiveMQ to a patched release. Below are the commands to upgrade ActiveMQ on a Linux environment.
# Download the patched version (e.g., 5.18.3)
wget https://archive.apache.org/dist/activemq/5.18.3/apache-activemq-5.18.3-bin.tar.gz
# Extract and replace the existing installation
tar -zxvf apache-activemq-5.18.3-bin.tar.gz
sudo systemctl stop activemq
sudo cp -r apache-activemq-5.18.3 /opt/activemq
sudo systemctl start activemq2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict network access to the OpenWire port (default: 61616) using firewall rules to allow only trusted IP addresses.
# Block external access to port 61616 and allow only trusted subnet
sudo ufw deny 61616/tcp
sudo ufw allow from 192.168.1.0/24 to any port 61616 proto tcp
sudo ufw reload3. Log Audit & IoC Verification Commands
Inspect ActiveMQ logs for indicators of compromise (IoC), specifically looking for unauthorized class instantiation attempts.
# Search for exploitation attempts in ActiveMQ logs
grep -ri 'ClassPathXmlApplicationContext' /opt/activemq/data/activemq.log
# Verify the running ActiveMQ version
ps -ef | grep activemqBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-46604) is an insecure deserialization flaw (CWE-502) within the OpenWire protocol marshaller of Apache ActiveMQ. The OpenWire protocol fails to properly validate class types during the serialization and deserialization process. This allows a remote attacker to manipulate serialized class types, forcing the application to instantiate any class available on the classpath.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by sending a specially crafted OpenWire command to the ActiveMQ broker or client (typically on port 61616). The payload specifies a class capable of loading external configurations, such as Spring's 'ClassPathXmlApplicationContext'. When the marshaller processes this payload, it instantiates the class, forcing the target to fetch and execute an arbitrary XML configuration file hosted on an attacker-controlled server. This leads to unauthenticated Remote Code Execution (RCE).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild. Successful exploitation grants the attacker full control over the host system without authentication. This can lead to complete infrastructure compromise, data exfiltration, ransomware deployment, and lateral movement within the internal network.
Official Vendor Advisories & References
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Frequently Asked SecOps Questions (CVE-2023-46604)
FAQQ1. How critical is CVE-2023-46604 and is it actively exploited in the wild?
CVE-2023-46604 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-46604?
Primary impacted vendors include apache across activemq. Scope summary: Apache ActiveMQ brokers and OpenWire clients (versions prior to 5.15.16, 5.16.7, 5.17.6, and 5.18.3)
Q3. What temporary mitigations or workarounds exist for CVE-2023-46604 before patching?
[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-46604
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.