Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2023-46604
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N C L H H 10.0 .9989 100.0 YES
AFFECTED
Product Versions Fixed
Apache ActiveMQ 5.18.0 – —
Apache ActiveMQ Legacy OpenWire Module 5.18.0 – —
TIMELINE
Oct 24 Reserved by apache
Oct 27 Published (CNA: apache)
Nov 2 Added to CISA KEV, remediation due 2023-11-23
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 24, 2023 | Reserved | Reserved by apache |
| October 27, 2023 | Published | Published (CNA: apache) |
| November 2, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-11-23 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-46604 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
