CVE-2023-46604

CRITICAL

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVSS v3.1 Score

10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
HIGH
Published: 10/27/2023Modified: 6/17/2026

Related Intelligence (1)

CRITICALRansomware

Armatura LLC Armatura One

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-contr

CVE-2023-46604CVE-2026-94591
CISA Advisories

References (14)

http://seclists.org/fulldisclosure/2024/Apr/18Mailing ListThird Party Advisoryhttps://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txtVendor Advisoryhttps://lists.debian.org/debian-lts-announce/2023/11/msg00013.htmlMailing Listhttps://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.htmlExploitThird Party Advisoryhttps://security.netapp.com/advisory/ntap-20231110-0010/Third Party Advisoryhttps://www.openwall.com/lists/oss-security/2023/10/27/5Mailing Listhttp://seclists.org/fulldisclosure/2024/Apr/18Mailing ListThird Party Advisoryhttps://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txtVendor Advisoryhttps://lists.debian.org/debian-lts-announce/2023/11/msg00013.htmlMailing Listhttps://lists.debian.org/debian-lts-announce/2024/10/msg00027.htmlMailing Listhttps://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.htmlExploitThird Party Advisoryhttps://security.netapp.com/advisory/ntap-20231110-0010/Third Party Advisoryhttps://www.openwall.com/lists/oss-security/2023/10/27/5Mailing Listhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604Third Party AdvisoryUS Government Resource