Apache ActiveMQ remote code execution
Messaging infrastructure is often treated as internal plumbing, yet it crosses service and trust boundaries continuously. This advisory is a useful reminder to inventory protocol listeners, authenticate every producer path, and treat serialization formats as…
- Original severity
- critical; CVSS 10.0 source-reported; not rescored by vulns.co
- Public source
- github advisory
- Program / vendor
- Apache
- Product / surface
- Apache ActiveMQ message broker
- Weakness
- Deserialization of untrusted data · CWE-502
- Affected boundary
- message-protocol to object-deserialization boundary
- Disclosure date
- 2023-10-27
- Public status checked
- 2026-09-10
- Public attribution
- nmarcoccio and sunSUNQ (credits listed by the source)
What the evidence established
The source identifies unsafe handling of serialized data in affected broker deployments.
Why the impact was credible
The source rates the issue Critical with CVSS 10.0, emphasizing the importance of patching and access control for broker endpoints.
Durable engineering lesson
Messaging infrastructure is often treated as internal plumbing, yet it crosses service and trust boundaries continuously. This advisory is a useful reminder to inventory protocol listeners, authenticate every producer path, and treat serialization formats as executable-risk surfaces when they can construct application objects.
Control pattern
Upgrade to the fixed release, limit management and transport exposure, and review trusted producer and consumer assumptions.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.