erroneo.us
Search all guides⌘K

Security Digest · Oct 25, 2023 · Vulnerability · Other

ActiveMQ CVE-2023-46604: OpenWire RCE Used by Ransomware

Unauthenticated RCE in ActiveMQ brokers and Java clients, fixed Oct 2023 and still abused in 2025. Move to 5.19.x or 6.3.x and hunt old exposure.

Published By erroneo.us Security Desk · Updated 3 min read13 sources

Our verdict

Check exposure

Fixed three years ago and abused by ransomware crews and later intruders; confirm every broker is on a supported 5.19.x or 6.3.x release, and hunt on any broker that was reachable and unpatched, because one crew patched the hole itself after breaking in.

Who must act: Anyone running ActiveMQ Classic brokers or Java OpenWire clients from 2023 or earlier, or any 5.18.x and older line, especially where port 61616 was reachable from the internet.

Who can relax: Teams that upgraded brokers and clients in late 2023, now run an active 5.19.x or 6.3.x release, and never exposed OpenWire beyond trusted networks.

Affected
ActiveMQ before 5.15.16
ActiveMQ 5.16.0 before 5.16.7
ActiveMQ 5.17.0 before 5.17.6
ActiveMQ 5.18.0 before 5.18.3
ActiveMQ Legacy OpenWire Module 5.8.0 through the same ranges
Java OpenWire clients (org.apache.activemq:activemq-client) in the same ranges
Fixed in
ActiveMQ 5.15.16, 5.16.7, 5.17.6, 5.18.3 (Oct 25, 2023)
Now: 5.19.11 or 6.3.2 (Sep 2026) or later, since 5.18.x and older lines are end of life
CVSS
10.0 (v3.1, CNA)
EPSS
99.9% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every ActiveMQ Classic broker and every application that bundles activemq-client, and record their versions.
  2. Upgrade brokers to an active release line, 5.19.11 or 6.3.2 or later; 5.18.x and older no longer get fixes.
  3. Update Java OpenWire clients too, since the flaw also lets a malicious broker attack a client.
  4. Block OpenWire (port 61616 by default) and the web console from the internet; allow only known application hosts.
  5. If a broker was reachable and unpatched after October 2023, hunt for compromise before trusting it, even if it now shows a fixed version.

How to check if you are affected or compromised

  • Look for the broker's java process spawning cmd.exe, powershell, msiexec, certutil, curl, wget, bash or sh.
  • Search for Rapid7's indicators: msiexec pulling m2.png or m4.png from 172.245.16.125, and files renamed with a .locked extension.
  • On Linux brokers, check /etc/cron.*/0anacron for edits, sshd settings that allow root login, and a games account whose shell is /bin/sh.
  • Compare the JAR files in the broker's lib directory with an official release; unexplained replacements downloaded with curl from repo1.maven.org match the DripDropper case.

What happened#

On October 25, 2023, Apache released ActiveMQ 5.18.3, alongside 5.17.6, 5.16.7 and 5.15.16, to fix CVE-2023-46604. The Apache advisory says the Java OpenWire protocol marshaller lets a remote attacker with network access to a broker or client run shell commands by making it instantiate any class on the classpath. Apache scores it CVSS 3.1 10.0 on the CVE record. NVD gives 9.8.

Exploitation came fast. Huntress saw related activity as early as October 10, before the fix. It explains that a crafted packet to OpenWire, usually port 61616, makes the broker load an XML configuration file from an attacker's URL. A public Metasploit module automates it. Rapid7 saw exploitation in two customer environments from October 27. It watched the broker's java.exe run msiexec to fetch MSI files disguised as PNGs, and Rapid7 tied the ransomware to HelloKitty. CISA added the CVE to KEV on November 2, 2023, with a November 23 deadline. It marks the bug as used in ransomware campaigns.

Who is affected#

ActiveMQ Classic before 5.15.16, 5.16.0 to 5.16.6, 5.17.0 to 5.17.5, and 5.18.0 to 5.18.2, plus the Legacy OpenWire Module. Java clients built on activemq-client in the same ranges are also affected: a hostile broker can attack them.

Do you really need to act?#

Most teams patched in 2023, so today's verdict is check exposure. Three things keep this open.

  • A fixed version does not prove a clean server. In August 2025, Red Canary described an intruder who probed dozens of cloud Linux brokers that were still unpatched. On some, the intruder installed the DripDropper malware, set up Sliver and Cloudflare Tunnels, and then downloaded official ActiveMQ JARs from Maven to replace the vulnerable ones. That locks out rivals and hides the entry point.
  • The 2023 fix lines are dead. Apache's download page marks 5.18.x and older as end of life. Only 5.19.x (5.19.11) and 6.3.x (6.3.2) are active.
  • Newer bugs exist. CVE-2026-34197 is an authenticated RCE through the Jolokia bridge on the web console. It was fixed in 5.19.4 and 6.2.3, per the advisory, and CISA added it to KEV on April 16, 2026. A bypass, CVE-2026-40466, needed 5.19.6 or 6.2.5. Apache's security page lists many more 2026 issues.

What to do now#

  1. Find brokers and clients. On a broker, run ls $ACTIVEMQ_HOME/lib/activemq-client-*.jar. In Java projects, run mvn dependency:tree -Dincludes=org.apache.activemq.
  2. Upgrade brokers to 5.19.11 or 6.3.2 or later, and update clients to match.
  3. Close port 61616 and the web console to the internet. Allow only known application hosts.
  4. For any broker that was reachable and unpatched after October 2023, run the checks below before trusting it. If you find signs of compromise, rebuild it.

How to tell if you were hit#

  • Look for the broker's Java process spawning cmd.exe, msiexec, certutil, curl, wget or a shell. Huntress published a Sigma rule for this.
  • Search proxy and EDR logs for Rapid7's indicators: 172.245.16.125, m2.png, m4.png, and encrypted files ending in .locked.
  • On Linux, check /etc/cron.*/0anacron for changes and look for SSH settings that allow root login. Also check whether the games account's shell was changed to /bin/sh.
  • Compare the JARs in lib/ with an official release. Replacements you cannot explain are a warning sign, not proof that the broker was patched.

Timeline#

  • — Earliest related activity Huntress reports.
  • — ActiveMQ 5.18.3, 5.17.6, 5.16.7 and 5.15.16 are released.
  • — CVE is published; Rapid7 sees ransomware exploitation.
  • — CISA adds CVE-2023-46604 to KEV.
  • — Red Canary's DripDropper report is published.
  • — CISA adds CVE-2026-34197 to KEV.
  • — ActiveMQ 6.3.2 is released; 5.19.11 follows on Sep 5.

Vulnerability records

  • CVE-2023-46604 · KEV 2023-11-02 · The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apache ActiveMQ — CVE-2023-46604 announcement activemq.apache.org
  2. Apache ActiveMQ — ActiveMQ 5.18.3 Release activemq.apache.org
  3. Apache ActiveMQ — ActiveMQ Classic downloads and release status activemq.apache.org
  4. Apache ActiveMQ — Classic security advisories activemq.apache.org
  5. CVE record — CVE-2023-46604 cve.org
  6. NVD — CVE-2023-46604 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2023-46604 cisa.gov
  8. Rapid7 — Suspected Exploitation of Apache ActiveMQ CVE-2023-46604 rapid7.com
  9. Huntress — Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 huntress.com
  10. Red Canary (via Zscaler) — Patching for persistence: How DripDropper Linux malware moves through the cloud zscaler.com
  11. Apache ActiveMQ — CVE-2026-34197 announcement activemq.apache.org
  12. CVE record — CVE-2026-34197 cve.org
  13. CVE record — CVE-2026-40466 cve.org