{"history":[{"alert":0,"cve":"CVE-2023-46604","id":22485,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":20104,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":18071,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":16135,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":14113,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":11895,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":9881,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":7429,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":1,"cve":"CVE-2023-46604","id":6206,"kind":"cna","observed_at":1793809200,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2025-11-03T21:50:00.516Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"vendor-advisory\", \"x_transferred\"], \"url\": \"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://www.openwall.com/lists/oss-security/2023/10/27/5\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://security.netapp.com/advisory/ntap-20231110-0010/\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html\"}, {\"tags\": [\"x_transferred\"], \"url\": \"http://seclists.org/fulldisclosure/2024/Apr/18\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2023-46604\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-02-04T15:16:07.619940Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2023-11-02\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:05:33.138Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-11-02T00:00:00.000Z\", \"value\": \"CVE-2023-46604 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\", \"packageName\": \"org.apache.activemq:activemq-client\", \"product\": \"Apache ActiveMQ\", \"vendor\": \"Apache Software Foundation\", \"versions\": [{\"lessThan\": \"5.18.3\", \"status\": \"affected\", \"version\": \"5.18.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.17.6\", \"status\": \"affected\", \"version\": \"5.17.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.16.7\", \"status\": \"affected\", \"version\": \"5.16.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.15.16\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}]}, {\"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\", \"packageName\": \"org.apache.activemq:activemq-openwire-legacy\", \"product\": \"Apache ActiveMQ Legacy OpenWire Module\", \"vendor\": \"Apache Software Foundation\", \"versions\": [{\"lessThan\": \"5.18.3\", \"status\": \"affected\", \"version\": \"5.18.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.17.6\", \"status\": \"affected\", \"version\": \"5.17.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.16.7\", \"status\": \"affected\", \"version\": \"5.16.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"5.15.16\", \"status\": \"affected\", \"version\": \"5.8.0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"yejie@threatbook.cn\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"<div>The Java OpenWire protocol marshaller is vulnerable to Remote Code \\nExecution. This vulnerability may allow a remote attacker with network \\naccess to either a Java-based OpenWire broker or client to run arbitrary\\n shell commands by manipulating serialized class types in the OpenWire \\nprotocol to cause either the client or the broker (respectively) to \\ninstantiate any class on the classpath.</div><div><br></div><div>Users are recommended to upgrade\\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \\nwhich fixes this issue.</div>\"}], \"value\": \"The Java OpenWire protocol marshaller is vulnerable to Remote Code \\nExecution. This vulnerability may allow a remote attacker with network \\naccess to either a Java-based OpenWire broker or client to run arbitrary\\n shell commands by manipulating serialized class types in the OpenWire \\nprotocol to cause either the client or the broker (respectively) to \\ninstantiate any class on the classpath.\\n\\nUsers are recommended to upgrade\\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \\nwhich fixes this issue.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2024-04-11T08:05:50.028Z\", \"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\"}, \"references\": [{\"tags\": [\"vendor-advisory\"], \"url\": \"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt\"}, {\"url\": \"https://www.openwall.com/lists/oss-security/2023/10/27/5\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20231110-0010/\"}, {\"url\": \"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html\"}, {\"url\": \"http://seclists.org/fulldisclosure/2024/Apr/18\"}], \"source\": {\"defect\": [\"AMQ-9370\"], \"discovery\": \"EXTERNAL\"}, \"title\": \"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"assignerShortName\": \"apache\", \"cveId\": \"CVE-2023-46604\", \"datePublished\": \"2023-10-27T14:59:31.046Z\", \"dateReserved\": \"2023-10-24T08:55:31.050Z\", \"dateUpdated\": \"2025-11-03T21:50:00.516Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2023-46604","id":5206,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":0,"cve":"CVE-2023-46604","id":2988,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99992, \"percentile\": 0.99986}"},{"alert":1,"cve":"CVE-2023-46604","id":742,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2023-46604\", \"cwes\": [\"CWE-502\"], \"dateAdded\": \"2023-11-02\", \"dueDate\": \"2023-11-23\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604\", \"product\": \"ActiveMQ\", \"requiredAction\": \"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.\", \"vendorProject\": \"Apache\", \"vulnerabilityName\": \"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability\"}"}],"record":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.activemq:activemq-client","product":"Apache ActiveMQ","vendor":"Apache Software Foundation","versions":[{"lessThan":"5.18.3","status":"affected","version":"5.18.0","versionType":"semver"},{"lessThan":"5.17.6","status":"affected","version":"5.17.0","versionType":"semver"},{"lessThan":"5.16.7","status":"affected","version":"5.16.0","versionType":"semver"},{"lessThan":"5.15.16","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.activemq:activemq-openwire-legacy","product":"Apache ActiveMQ Legacy OpenWire Module","vendor":"Apache Software Foundation","versions":[{"lessThan":"5.18.3","status":"affected","version":"5.18.0","versionType":"semver"},{"lessThan":"5.17.6","status":"affected","version":"5.17.0","versionType":"semver"},{"lessThan":"5.16.7","status":"affected","version":"5.16.0","versionType":"semver"},{"lessThan":"5.15.16","status":"affected","version":"5.8.0","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T21:50:00.516Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["vendor-advisory","x_transferred"],"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"},{"tags":["x_transferred"],"url":"https://www.openwall.com/lists/oss-security/2023/10/27/5"},{"tags":["x_transferred"],"url":"https://security.netapp.com/advisory/ntap-20231110-0010/"},{"tags":["x_transferred"],"url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Apr/18"},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2023-46604","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-04T15:16:07.619940Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2023-11-02","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2025-10-21T23:05:33.138Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604"}],"timeline":[{"lang":"en","time":"2023-11-02T00:00:00.000Z","value":"CVE-2023-46604 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.activemq:activemq-client","product":"Apache ActiveMQ","vendor":"Apache Software Foundation","versions":[{"lessThan":"5.18.3","status":"affected","version":"5.18.0","versionType":"semver"},{"lessThan":"5.17.6","status":"affected","version":"5.17.0","versionType":"semver"},{"lessThan":"5.16.7","status":"affected","version":"5.16.0","versionType":"semver"},{"lessThan":"5.15.16","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.activemq:activemq-openwire-legacy","product":"Apache ActiveMQ Legacy OpenWire Module","vendor":"Apache Software Foundation","versions":[{"lessThan":"5.18.3","status":"affected","version":"5.18.0","versionType":"semver"},{"lessThan":"5.17.6","status":"affected","version":"5.17.0","versionType":"semver"},{"lessThan":"5.16.7","status":"affected","version":"5.16.0","versionType":"semver"},{"lessThan":"5.15.16","status":"affected","version":"5.8.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"yejie@threatbook.cn"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.</div><div><br></div><div>Users are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.</div>"}],"value":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-04-11T08:05:50.028Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"},{"url":"https://www.openwall.com/lists/oss-security/2023/10/27/5"},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010/"},{"url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html"},{"url":"http://seclists.org/fulldisclosure/2024/Apr/18"}],"source":{"defect":["AMQ-9370"],"discovery":"EXTERNAL"},"title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2023-46604","datePublished":"2023-10-27T14:59:31.046Z","dateReserved":"2023-10-24T08:55:31.050Z","dateUpdated":"2025-11-03T21:50:00.516Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794241201,"cve":"CVE-2023-46604","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","epss":{"date":"2026-11-12","epss":0.99992,"percentile":0.99986},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2023-46604","cwes":["CWE-502"],"dateAdded":"2023-11-02","dueDate":"2023-11-23","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604","product":"ActiveMQ","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","shortDescription":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","vendorProject":"Apache","vulnerabilityName":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability"},"kev_checked":1794522003,"products":"Apache Software Foundation Apache ActiveMQ, Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module","references":["https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","https://www.openwall.com/lists/oss-security/2023/10/27/5","https://security.netapp.com/advisory/ntap-20231110-0010/","https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html","http://seclists.org/fulldisclosure/2024/Apr/18","https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"apache","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","updated_at":1794500401,"workarounds":""},"sources":[]}