---
id: "CVE-2016-3088"
kind: "vulnerability"
aliases: ["CVE-2016-3088"]
title: "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.98518
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache ActiveMQ", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["activemq", "exploited", "java", "package", "self-hosted"]
not_affected_if: ["activemq-not-installed", "fileserver-disabled"]
published_at: "2016-06-01T20:59:04+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3088", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-3088", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3088", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability

Apache ActiveMQ's Fileserver web application lets remote attackers upload files with an HTTP PUT and then move them with an HTTP MOVE, so an attacker can place and run arbitrary files. CISA lists this as actively exploited in the wild, and EPSS puts exploitation probability at about 0.985.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache ActiveMQ affected ? fixed ?

## Fix

Apply the vendor update for Apache ActiveMQ per Apache's instructions; the fixed version is unknown from these sources.
Remove or disable the Fileserver web application if it is not needed; the exact setting is unknown from these sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3088
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-3088
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-3088

## From the sources

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_