CVE-2023-46604—Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

漏洞名称

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

描述

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

已知用于勒索软件活动吗？

勒索软件状态：

KNOWN

采集行动

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

其他说明

• https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• https://nvd.nist.gov/vuln/detail/CVE-2023-46604

相关新闻文章

• Actively exploited Apache ActiveMQ flaw impacts 6,400 serversApril 21, 2026
• 13-year-old bug in ActiveMQ lets hackers remotely execute commandsApril 8, 2026
• Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet CampaignApril 7, 2026
• Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux SystemsAugust 19, 2025
• Mimo Hackers Exploit CVE-2025-32432 in Craft CMS to Deploy Cryptominer and ProxywareMay 28, 2025

相关 CWE

• CWE-502