Apache ActiveMQ

Querying Apache ActiveMQ

curl "https://api.attestd.io/v1/check?product=apache_activemq&version=5.18.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

ActiveMQ 5.18.0 is affected by CVE-2023-46604 (OpenWire deserialization RCE, CISA KEV). Expect risk_state: "critical" and actively_exploited: true.

{
  "product": "apache_activemq",
  "version": "5.18.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "5.18.3",
  "confidence": 0.94,
  "cve_ids": ["CVE-2023-46604"],
  "last_updated": "2026-02-23T18:21:30Z"
}

ActiveMQ 5.18.3 includes the patch for CVE-2023-46604 and has no known critical vulnerabilities at the time of the last synthesis run.

curl "https://api.attestd.io/v1/check?product=apache_activemq&version=5.18.3" \
  -H "Authorization: Bearer $ATTESTD_KEY"

CVE history

ActiveMQ's CVE history is dominated by Java deserialization vulnerabilities in its message processing pipeline and management interfaces. CVE-2023-46604 represents the most severe recent case: a pre-authentication RCE over the OpenWire port (default 61616) that requires no credentials and was actively weaponized in ransomware campaigns.