Is CVE-2023-46604 actively exploited?

CVE-2023-46604 has no public evidence of in-the-wild exploitation as of 2025-11-04.

What is the CVSS score for CVE-2023-46604?

CVE-2023-46604 has a CVSS score of 10 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H.

How do I patch CVE-2023-46604?

Patch guidance is available from apache security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2023-46604.

Fix CVE-2023-46604 - CRITICAL apache activemq

Q: Which products are affected by CVE-2023-46604?

13 products: apache activemq, apache activemq, apache activemq, apache activemq, apache activemq legacy openwire module, and 8 more.

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: changed
Confidentiality: low
Integrity: high
Availability: high
Weaknesses: CWE-502 · Insecure Deserialization

Metadata

Primary Vendor: APACHE
Published: 10/27/2023
Last Modified: 11/4/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

apache : activemqapache : activemqapache : activemqapache : activemqapache : activemq_legacy_openwire_moduleapache : activemq_legacy_openwire_moduleapache : activemq_legacy_openwire_moduleapache : activemq_legacy_openwire_moduledebian : debian_linuxdebian : debian_linuxnetapp : e-series_santricity_unified_managernetapp : e-series_santricity_web_services_proxynetapp : santricity_storage_plugin

Remediation Guidance

Executive Summary

View on NIST NVD