Security feed

24 October 2026

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Apache ActiveMQ Improper Input Validation Vulnerability

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

ActiveMQ CVE-2016-3088

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-3088

ActiveMQ

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-3088
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2899 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:15 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Announced 2 Nov 2023

ActiveMQ CVE-2023-46604

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-46604

ActiveMQ

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-46604
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1231 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:58:39 GMT
Publisher date: Thu, 02 Nov 2023 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Apache ActiveMQ Improper Input Validation Vulnerability

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Announced 16 Apr 2026

ActiveMQ CVE-2026-34197

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2026-34197

ActiveMQ

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-34197
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #189 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:42:07 GMT
Publisher date: Thu, 16 Apr 2026 00:00:00 GMT

Read the original announcement