---
id: "CVE-2023-46604"
kind: "vulnerability"
aliases: ["CVE-2023-46604"]
title: "The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "apache activemq", "fixed": ["5.15.16"], "affected": "< 5.15.16", "ecosystem": "vendor"}, {"name": "apache activemq", "fixed": ["5.16.7"], "affected": ">= 5.16.0, < 5.16.7", "ecosystem": "vendor"}, {"name": "apache activemq", "fixed": ["5.17.6"], "affected": ">= 5.17.0, < 5.17.6", "ecosystem": "vendor"}, {"name": "apache activemq", "fixed": ["5.18.3"], "affected": ">= 5.18.0, < 5.18.3", "ecosystem": "vendor"}, {"name": "apache activemq legacy openwire module", "fixed": ["5.15.16"], "affected": "< 5.15.16", "ecosystem": "vendor"}, {"name": "apache activemq legacy openwire module", "fixed": ["5.16.7"], "affected": ">= 5.16.0, < 5.16.7", "ecosystem": "vendor"}, {"name": "apache activemq legacy openwire module", "fixed": ["5.17.6"], "affected": ">= 5.17.0, < 5.17.6", "ecosystem": "vendor"}, {"name": "apache activemq legacy openwire module", "fixed": ["5.18.3"], "affected": ">= 5.18.0, < 5.18.3", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "netapp e-series santricity unified manager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp e-series santricity web services proxy", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp santricity storage plugin", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Apache ActiveMQ", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["activemq", "exploited", "java", "openwire", "package", "ransomware", "self-hosted"]
not_affected_if: ["no-openwire-exposure"]
published_at: "2023-10-27T15:15:14+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution

Apache ActiveMQ brokers accept serialized Java class types over the OpenWire protocol and instantiate them without checks. A remote attacker with network access to the broker can make it run shell commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache activemq affected < 5.15.16 fixed 5.15.16
- vendor:apache activemq affected >= 5.16.0, < 5.16.7 fixed 5.16.7
- vendor:apache activemq affected >= 5.17.0, < 5.17.6 fixed 5.17.6
- vendor:apache activemq affected >= 5.18.0, < 5.18.3 fixed 5.18.3
- vendor:apache activemq legacy openwire module affected < 5.15.16 fixed 5.15.16
- vendor:apache activemq legacy openwire module affected >= 5.16.0, < 5.16.7 fixed 5.16.7
- vendor:apache activemq legacy openwire module affected >= 5.17.0, < 5.17.6 fixed 5.17.6
- vendor:apache activemq legacy openwire module affected >= 5.18.0, < 5.18.3 fixed 5.18.3
- vendor:debian linux affected = 10.0 fixed ?
- vendor:debian linux affected = 11.0 fixed ?
- vendor:netapp e-series santricity unified manager affected ? fixed ?
- vendor:netapp e-series santricity web services proxy affected ? fixed ?
- vendor:netapp santricity storage plugin affected ? fixed ?
- vendor:Apache ActiveMQ affected ? fixed ?

## Fix

Apply the mitigation or upgrade per Apache vendor instructions; the sources do not name the fixed versions.
If no mitigation is available, discontinue use of the product as CISA requires.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-46604

## From the sources

The Java OpenWire protocol marshaller is vulnerable to Remote Code 
Execution. This vulnerability may allow a remote attacker with network 
access to either a Java-based OpenWire broker or client to run arbitrary
 shell commands by manipulating serialized class types in the OpenWire 
protocol to cause either the client or the broker (respectively) to 
instantiate any class on the classpath.

Users are recommended to upgrade
 both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 
which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_