Loading story…
Attackers have actively exploited CVE-2023-46604, a remote code execution flaw in Apache ActiveMQ, to compromise Linux systems and install Kinsing (also known as h2miner). The vulnerability stems from improper validation of throwable class types in OpenWire commands during unmarshalling, allowing malicious code execution on exposed brokers. Trend Micro reported that intrusions led to the delivery of cryptocurrency-mining payloads and rootkit components, causing performance degradation and broader infrastructure impact.
Affected software includes multiple Apache ActiveMQ and Legacy OpenWire Module versions prior to the vendor’s patched releases. Apache addressed the issue by adding a validateIsThrowable check in the BaseDataStreamMarshall class, and organizations were urged to upgrade to 5.15.16, 5.16.7, 5.17.6, or 5.18.3 to block further exploitation and malware deployment.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Fortinet reported that attackers exploiting CVE-2023-46604 were deploying multiple malware families, including the newly identified Go-based botnet GoTitan, PrCtrl Rat, Sliver, Kinsing, and Ddostf. The report detailed an exploitation chain over ActiveMQ's OpenWire protocol that loads malicious XML from a remote URL to execute attacker-controlled code.
On November 3, 2023, Apache published an update describing CVE-2023-46604 as a remote code execution flaw in the Java OpenWire protocol marshaller affecting ActiveMQ brokers, ActiveMQ Artemis, and Java-based OpenWire clients. Apache advised upgrades and released fixed versions including ActiveMQ 6.0.0, 5.18.3, 5.17.6, 5.16.7, 5.15.16, and ActiveMQ Artemis 2.31.2.
The reference identifies fixed releases for affected Apache ActiveMQ and Legacy OpenWire Module versions and recommends upgrading to 5.15.16, 5.16.7, 5.17.6, or 5.18.3. The associated AMQ-9370 patch adds a validateIsThrowable method to BaseDataStreamMarshall.
The exploitation activity was observed leading to the download and installation of Kinsing (also known as h2miner) on vulnerable Linux systems, where it deploys cryptocurrency-mining payloads that degrade performance and damage infrastructure.
Trend Micro reported that attackers are actively exploiting CVE-2023-46604, a remote code execution vulnerability in Apache ActiveMQ caused by improper validation of throwable class types in OpenWire commands during unmarshalling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
activemq.apache.org
Open sourcefortinet.com
Open sourcetrendmicro.com
Open sourceactivemq.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are exploiting **Apache ActiveMQ** flaw **`CVE-2023-46604`**, an unauthenticated remote code execution bug in the OpenWire protocol caused by unsafe deserialization, to gain initial access to exposed brokers. Security reporting tied the vulnerability to real-world intrusions soon after disclosure, and later incidents showed it being used to compromise both Windows- and Linux-based environments. In one campaign, the access was leveraged to deploy **LockBit ransomware** after attackers obtained **RDP** access, underscoring how a broker compromise can quickly lead to broader domain or server takeover. Separate investigations found Linux-focused post-exploitation activity in which intruders used the same ActiveMQ weakness to install a **Sliver** implant and a newly identified malware family, **DripDropper**, which relied on an attacker-controlled **Dropbox** account for command-and-control and persistence actions. Researchers reported attackers modifying **SSH** settings to enable root access, adding persistence through **cron** and SSH configuration changes, and even **patching the vulnerable ActiveMQ service after entry** to block rival attackers and reduce the chance of discovery. Although Apache released fixes in October 2023, vulnerable and delayed-to-patch deployments have remained exposed long enough to support continued exploitation.
Jul 12, 2026
Apache disclosed two vulnerabilities affecting multiple **ActiveMQ** components, including Client, Broker, and bundled distributions. **CVE-2026-33227** is a low-severity pathname restriction flaw that lets an authenticated user manipulate a supplied `key` value to traverse the classpath in two cases: when creating a **STOMP** consumer and when browsing messages through the web console. Apache warned the issue could expose classpath resource loading and potentially be chained with another attack. The flaw affects the 5.x branch before **5.19.3** and the 6.x branch from **6.0.0** before **6.2.2**, but Apache said those initial fixes were incomplete on Windows because of path separator handling, and recommended upgrading instead to **5.19.4** or **6.2.3**. Apache also published **CVE-2026-39304**, an important denial-of-service flaw in ActiveMQ's **NIO SSL transports** caused by incorrect handling of **TLS 1.3 `KeyUpdate`** messages. A client can repeatedly trigger updates and exhaust broker memory in the SSL engine, causing out-of-memory crashes and service disruption. Apache added that related handshake handling is also broken for earlier TLS versions such as **TLS 1.2**, though those cases lead to hung connections rather than memory exhaustion. The DoS issue affects the 5.x branch before **5.19.4** and the 6.x branch from **6.0.0** before **6.2.4**; users are advised to upgrade to **5.19.5** or **6.2.4**.
Jun 29, 2026
Apache disclosed **CVE-2026-34197**, an important-severity remote code execution flaw in **Apache ActiveMQ Broker** and **Apache ActiveMQ Classic** that lets authenticated users execute code through the Jolokia JMX-HTTP bridge exposed at `/api/jolokia/`. The default Jolokia access policy permits `exec` operations on ActiveMQ MBeans, allowing attackers to call methods such as `BrokerService.addNetworkConnector(String)` and `BrokerService.addConnector(String)` with a crafted discovery URI. The exploit abuses the VM transport `brokerConfig` parameter to load a remote Spring XML application context via `ResourceXmlApplicationContext`, and Spring may instantiate singleton beans before ActiveMQ validates the configuration, enabling arbitrary code execution in the broker JVM, including through methods like `Runtime.exec()`. Apache said the issue affects versions before **5.19.4** in the 5.x line and **6.0.0 through before 6.2.3** in the 6.x line, and recommends upgrading to **5.19.5** or **6.2.3**; the vulnerability was reported by Naveen Sunkavally of Horizon3.ai.
Aug 14, 2026