---
title: "ActiveMQ CVE-2023-46604: OpenWire RCE Used by Ransomware"
url: https://erroneo.us/security/briefs/activemq-cve-2023-46604-openwire-rce/
description: "Unauthenticated RCE in ActiveMQ brokers and Java clients, fixed Oct 2023 and still abused in 2025. Move to 5.19.x or 6.3.x and hunt old exposure."
type: security-brief
section: "Security Digest"
date_published: 2023-10-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-46604"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ActiveMQ CVE-2023-46604: OpenWire RCE Used by Ransomware

**Verdict: Check exposure.** Fixed three years ago and abused by ransomware crews and later intruders; confirm every broker is on a supported 5.19.x or 6.3.x release, and hunt on any broker that was reachable and unpatched, because one crew patched the hole itself after breaking in.

- **Who must act:** Anyone running ActiveMQ Classic brokers or Java OpenWire clients from 2023 or earlier, or any 5.18.x and older line, especially where port 61616 was reachable from the internet.
- **Who can relax:** Teams that upgraded brokers and clients in late 2023, now run an active 5.19.x or 6.3.x release, and never exposed OpenWire beyond trusted networks.
- **Affected:** ActiveMQ before 5.15.16; ActiveMQ 5.16.0 before 5.16.7; ActiveMQ 5.17.0 before 5.17.6; ActiveMQ 5.18.0 before 5.18.3; ActiveMQ Legacy OpenWire Module 5.8.0 through the same ranges; Java OpenWire clients (org.apache.activemq:activemq-client) in the same ranges
- **Fixed:** ActiveMQ 5.15.16, 5.16.7, 5.17.6, 5.18.3 (Oct 25, 2023); Now: 5.19.11 or 6.3.2 (Sep 2026) or later, since 5.18.x and older lines are end of life
- **CVEs:** CVE-2023-46604
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every ActiveMQ Classic broker and every application that bundles activemq-client, and record their versions.
2. Upgrade brokers to an active release line, 5.19.11 or 6.3.2 or later; 5.18.x and older no longer get fixes.
3. Update Java OpenWire clients too, since the flaw also lets a malicious broker attack a client.
4. Block OpenWire (port 61616 by default) and the web console from the internet; allow only known application hosts.
5. If a broker was reachable and unpatched after October 2023, hunt for compromise before trusting it, even if it now shows a fixed version.

### How to check if you are affected

- Look for the broker's java process spawning cmd.exe, powershell, msiexec, certutil, curl, wget, bash or sh.
- Search for Rapid7's indicators: msiexec pulling m2.png or m4.png from 172.245.16.125, and files renamed with a .locked extension.
- On Linux brokers, check /etc/cron.*/0anacron for edits, sshd settings that allow root login, and a games account whose shell is /bin/sh.
- Compare the JAR files in the broker's lib directory with an official release; unexplained replacements downloaded with curl from repo1.maven.org match the DripDropper case.

## What happened

On October 25, 2023, Apache released [ActiveMQ 5.18.3](https://activemq.apache.org/components/classic/download/classic-05-18-03), alongside 5.17.6, 5.16.7 and 5.15.16, to fix CVE-2023-46604. The [Apache advisory](https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt) says the Java OpenWire protocol marshaller lets a remote attacker with network access to a broker or client run shell commands by making it instantiate any class on the classpath. Apache scores it CVSS 3.1 10.0 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-46604). [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-46604) gives 9.8.

Exploitation came fast. [Huntress](https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604) saw related activity as early as October 10, before the fix. It explains that a crafted packet to OpenWire, usually port 61616, makes the broker load an XML configuration file from an attacker's URL. A public Metasploit module automates it. [Rapid7](https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/) saw exploitation in two customer environments from October 27. It watched the broker's `java.exe` run `msiexec` to fetch MSI files disguised as PNGs, and Rapid7 tied the ransomware to HelloKitty. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604) on November 2, 2023, with a November 23 deadline. It marks the bug as used in ransomware campaigns.

## Who is affected

ActiveMQ Classic before 5.15.16, 5.16.0 to 5.16.6, 5.17.0 to 5.17.5, and 5.18.0 to 5.18.2, plus the Legacy OpenWire Module. Java clients built on `activemq-client` in the same ranges are also affected: a hostile broker can attack them.

## Do you really need to act?

Most teams patched in 2023, so today's verdict is check exposure. Three things keep this open.

- **A fixed version does not prove a clean server.** In August 2025, [Red Canary](https://www.zscaler.com/blogs/cybersecurity-best-practices/dripdropper-linux-malware) described an intruder who probed dozens of cloud Linux brokers that were still unpatched. On some, the intruder installed the DripDropper malware, set up Sliver and Cloudflare Tunnels, and then downloaded official ActiveMQ JARs from Maven to replace the vulnerable ones. That locks out rivals and hides the entry point.
- **The 2023 fix lines are dead.** Apache's [download page](https://activemq.apache.org/components/classic/download/) marks 5.18.x and older as end of life. Only 5.19.x (5.19.11) and 6.3.x (6.3.2) are active.
- **Newer bugs exist.** [CVE-2026-34197](https://www.cve.org/CVERecord?id=CVE-2026-34197) is an authenticated RCE through the Jolokia bridge on the web console. It was fixed in 5.19.4 and 6.2.3, per the [advisory](https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt), and CISA added it to KEV on April 16, 2026. A bypass, [CVE-2026-40466](https://www.cve.org/CVERecord?id=CVE-2026-40466), needed 5.19.6 or 6.2.5. Apache's [security page](https://activemq.apache.org/components/classic/security) lists many more 2026 issues.

## What to do now

1. Find brokers and clients. On a broker, run `ls $ACTIVEMQ_HOME/lib/activemq-client-*.jar`. In Java projects, run `mvn dependency:tree -Dincludes=org.apache.activemq`.
2. Upgrade brokers to 5.19.11 or 6.3.2 or later, and update clients to match.
3. Close port 61616 and the web console to the internet. Allow only known application hosts.
4. For any broker that was reachable and unpatched after October 2023, run the checks below before trusting it. If you find signs of compromise, rebuild it.

## How to tell if you were hit

- Look for the broker's Java process spawning `cmd.exe`, `msiexec`, `certutil`, `curl`, `wget` or a shell. Huntress published a Sigma rule for this.
- Search proxy and EDR logs for Rapid7's indicators: `172.245.16.125`, `m2.png`, `m4.png`, and encrypted files ending in `.locked`.
- On Linux, check `/etc/cron.*/0anacron` for changes and look for SSH settings that allow root login. Also check whether the `games` account's shell was changed to `/bin/sh`.
- Compare the JARs in `lib/` with an official release. Replacements you cannot explain are a warning sign, not proof that the broker was patched.

## Timeline

- Oct 10, 2023 — Earliest related activity Huntress reports.
- Oct 25, 2023 — ActiveMQ 5.18.3, 5.17.6, 5.16.7 and 5.15.16 are released.
- Oct 27, 2023 — CVE is published; Rapid7 sees ransomware exploitation.
- Nov 2, 2023 — CISA adds CVE-2023-46604 to KEV.
- Aug 19, 2025 — Red Canary's DripDropper report is published.
- Apr 16, 2026 — CISA adds CVE-2026-34197 to KEV.
- Sep 2, 2026 — ActiveMQ 6.3.2 is released; 5.19.11 follows on Sep 5.

## Sources

1. [Apache ActiveMQ — CVE-2023-46604 announcement](https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt)
2. [Apache ActiveMQ — ActiveMQ 5.18.3 Release](https://activemq.apache.org/components/classic/download/classic-05-18-03)
3. [Apache ActiveMQ — ActiveMQ Classic downloads and release status](https://activemq.apache.org/components/classic/download/)
4. [Apache ActiveMQ — Classic security advisories](https://activemq.apache.org/components/classic/security)
5. [CVE record — CVE-2023-46604](https://www.cve.org/CVERecord?id=CVE-2023-46604)
6. [NVD — CVE-2023-46604](https://nvd.nist.gov/vuln/detail/CVE-2023-46604)
7. [CISA — Known Exploited Vulnerabilities: CVE-2023-46604](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604)
8. [Rapid7 — Suspected Exploitation of Apache ActiveMQ CVE-2023-46604](https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/)
9. [Huntress — Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604](https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604)
10. [Red Canary (via Zscaler) — Patching for persistence: How DripDropper Linux malware moves through the cloud](https://www.zscaler.com/blogs/cybersecurity-best-practices/dripdropper-linux-malware)
11. [Apache ActiveMQ — CVE-2026-34197 announcement](https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt)
12. [CVE record — CVE-2026-34197](https://www.cve.org/CVERecord?id=CVE-2026-34197)
13. [CVE record — CVE-2026-40466](https://www.cve.org/CVERecord?id=CVE-2026-40466)

---
Source page: https://erroneo.us/security/briefs/activemq-cve-2023-46604-openwire-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt