{"id":"CVE-2016-3088","kind":"vulnerability","aliases":["CVE-2016-3088"],"related":[],"title":"Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability","description":"The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request\n\nCISA required action: Apply updates per vendor instructions.","summary":"Apache ActiveMQ's Fileserver web application lets remote attackers upload files with an HTTP PUT and then move them with an HTTP MOVE, so an attacker can place and run arbitrary files. CISA lists this as actively exploited in the wild, and EPSS puts exploitation probability at about 0.985.","severity":"critical","cvss":9.8,"epss":0.98518,"exploited":true,"exploited_at":"2022-02-10T00:00:00+00:00","products":[{"name":"Apache ActiveMQ","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["activemq","exploited","java","package","self-hosted"],"not_affected_if":["activemq-not-installed","fileserver-disabled"],"how_to_check":null,"fix":"Apply the vendor update for Apache ActiveMQ per Apache's instructions; the fixed version is unknown from these sources.\nRemove or disable the Fileserver web application if it is not needed; the exact setting is unknown from these sources.","status":"open","published_at":"2016-06-01T20:59:04+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:51+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:28:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update for Apache ActiveMQ per Apache's instructions; the fixed version is unknown from these sources.\nRemove or disable the Fileserver web application if it is not needed; the exact setting is unknown from these sources.","reach":"network","impact":"high","summary":"Apache ActiveMQ's Fileserver web application lets remote attackers upload files with an HTTP PUT and then move them with an HTTP MOVE, so an attacker can place and run arbitrary files. CISA lists this as actively exploited in the wild, and EPSS puts exploitation probability at about 0.985.","category":"package","who_cares":["activemq","java","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker uploads and executes arbitrary files on the ActiveMQ server.","analyst_note":"Find the affected and fixed ActiveMQ versions, the Fileserver disable setting, and a detection command at the Apache ActiveMQ security advisory for CVE-2016-3088 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["activemq-not-installed","fileserver-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000511,"input_tokens":2844,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':10A,13A '-3088':11A,14A '0.985':72B 'action':101C 'activ':60B 'activemq':2A,4A,16A,17B,25B,79C 'allow':80C 'apach':1A,3A,24B,78C 'apache':15A 'appli':102C 'applic':29B,76C 'arbitrari':54B,87C 'attack':32B,49B,82C 'cisa':56B,99C 'cve':9A,12A 'epss':66B 'execut':86C 'exploit':18B,61B,68B 'file':34B,55B,88C 'fileserv':27B,74C 'follow':93C 'host':23B 'http':37B,45B,91C,96C 'improp':5A 'input':6A 'instruct':106C 'java':19B 'let':30B 'list':57B 'move':41B,46B,97C 'packag':20B 'per':104C 'place':51B 'probabl':69B 'put':38B,67B,92C 'remot':31B,81C 'request':98C 'requir':100C 'run':53B 'self':22B 'self-host':21B 'updat':103C 'upload':33B,84C 'valid':7A 'vendor':105C 'via':89C 'vulner':8A 'web':28B,75C 'wild':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-06-01T20:59:04+00:00","kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-3088","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3088","severity":null,"published_at":"2022-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2016-3088","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3088","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-3088","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3088","severity":null,"published_at":"2016-06-01T20:59:04+00:00","modified_at":"2026-06-17T00:44:56+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}