CVE-2023-46604
published 2023-10-27CVE-2023-46604: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2023-11-23
Exploited in the wild
EPSS
99.89%
100.0th percentile
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.15.16 | 5.15.16 |
| apache | activemq | >= 0 < 5.16.1-1+deb11u1 | 5.16.1-1+deb11u1 |
| apache | activemq | >= 0 < 5.17.2+dfsg-2+deb12u1 | 5.17.2+dfsg-2+deb12u1 |
| apache | activemq | >= 0 < 5.17.6+dfsg-1 | 5.17.6+dfsg-1 |
| apache | activemq | >= 0 < 5.16.1-1ubuntu0.1 | 5.16.1-1ubuntu0.1 |
| apache | activemq | >= 0 < 5.13.2+dfsg-2ubuntu0.1~esm1 | 5.13.2+dfsg-2ubuntu0.1~esm1 |
| apache | activemq | >= 0 < 5.15.8-2~18.04.1~esm1 | 5.15.8-2~18.04.1~esm1 |
| apache | activemq | >= 0 < 5.15.11-1ubuntu0.1~esm1 | 5.15.11-1ubuntu0.1~esm1 |
| apache | activemq | >= 0 < 5.16.1-1ubuntu0.1~esm1 | 5.16.1-1ubuntu0.1~esm1 |
| apache | activemq | >= 5.16.0 < 5.16.7 | 5.16.7 |
| apache | activemq | >= 5.17.0 < 5.17.6 | 5.17.6 |
| apache | activemq | >= 5.18.0 < 5.18.3 | 5.18.3 |
| apache | activemq_legacy_openwire_module | < 5.15.16 | 5.15.16 |
| apache | activemq_legacy_openwire_module | >= 5.16.0 < 5.16.7 | 5.16.7 |
| apache | activemq_legacy_openwire_module | >= 5.17.0 < 5.17.6 | 5.17.6 |
| apache | activemq_legacy_openwire_module | >= 5.18.0 < 5.18.3 | 5.18.3 |
| apache_software_foundation | apache_activemq | < 5.15.16 | 5.15.16 |
| apache_software_foundation | apache_activemq | >= 5.16.0 < 5.16.7 | 5.16.7 |
| apache_software_foundation | apache_activemq | >= 5.17.0 < 5.17.6 | 5.17.6 |
| apache_software_foundation | apache_activemq | >= 5.18.0 < 5.18.3 | 5.18.3 |
| apache_software_foundation | apache_activemq_legacy_openwire_module | >= 5.16.0 < 5.16.7 | 5.16.7 |
| apache_software_foundation | apache_activemq_legacy_openwire_module | >= 5.17.0 < 5.17.6 | 5.17.6 |
| apache_software_foundation | apache_activemq_legacy_openwire_module | >= 5.18.0 < 5.18.3 | 5.18.3 |
| apache_software_foundation | apache_activemq_legacy_openwire_module | >= 5.8.0 < 5.15.16 | 5.15.16 |
| debian | activemq | < activemq 5.17.2+dfsg-2+deb12u1 (bookworm) | activemq 5.17.2+dfsg-2+deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
rule JAVA_ClassPathXmlApplicationContext_CVE_2023_46604_A{meta:author = "Peter Girnus"description = "Detects exploit variant used by Kinsing Malware for CVE-2023-46604 ClassPathXmlApplicationContext."cve = "CVE-2023-46604"hash = "d8f55bbbcc20e81e46b9bf78f93b73f002c76a8fcdb4dc2ae21b8609445c14f9"strings:$s1 = ""$r1 = /\bclass=["']java\.lang\.ProcessBuilder["']/ nocase$r2 = /[^<]+\.(exe|vbs|bat|ps1|psm|sh)/ nocasecondition:all of them}- →Monitor for writes to /etc/ld.so.preload as a post-exploitation persistence/rootkit indicator following ActiveMQ exploitation. ↗
- →Detect cron entries that download and execute a remote shell script every minute — a persistence mechanism used by Kinsing post-exploitation of CVE-2023-46604. ↗
- →Alert on ActiveMQ broker logs containing the internal transport protocol 'VM' combined with the 'brokerConfig=xbean:http://' query parameter, which indicates active exploitation attempts. ↗
- →The exploit leverages the ProcessBuilder method via OpenWire protocol manipulation. Detect network traffic to ActiveMQ (default port 61616) that contains serialized OpenWire commands referencing ClassPathXmlApplicationContext or ProcessBuilder class types. ↗
- →Monitor for the scheduled task name 'Update service for Windows Service' created via schtasks, which is used by the H2Miner/Kinsing XMRig dropper (1.ps1) for persistence on Windows systems. ↗
- →The HelloKitty ransomware group has also been observed exploiting CVE-2023-46604 to deploy ransomware. Detections should cover both cryptominer and ransomware post-exploitation payloads. ↗
- ·The YARA rule's $s1 string value appears to be empty/truncated in the source document — the actual string content is not visible in the published text and should be verified against the original rule before deployment. ↗
- ·The Kinsing aarch64 sample (da753ebcfe793614129fc11890acedbc) is specifically attributed to CVE-2023-46604 Apache ActiveMQ attacks in 2023, while other Kinsing hashes in the same table are linked to different CVEs (Log4j, Openfire) and should not be attributed solely to CVE-2023-46604. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vulncheck10.0CRITICAL
cisa9.8CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
vendor_oracle9.8CRITICAL
vendor_ubuntu8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle Financial Services Analytical Applications Infrastructure deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Financial Services Analytical Applications Infrastructure deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
A vulnerability was found in Oracle Financial Services Analytical Applications Infrastructure up to 8.1.2. It has been declared as very critical. Affected is an unknown function of the component Infrastructure. Such manipulation leads to deserialization.
This vulnerability is documented as CVE-2023-46604. The attack can be executed remotely. Additionally, an exploit exists.
VulDB
Oracle Communications Session Report Manager up to 9.0.2.0.1 Security deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Communications Session Report Manager up to 9.0.2.0.1 Security deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
A vulnerability identified as very critical has been detected in Oracle Communications Session Report Manager up to 9.0.2.0.1. This vulnerability affects unknown code of the component Security. Performing a manipulation results in deserialization.
This vulnerability is identified as CVE-2023-46604. The attack can be initiated remotely. Additionally, an exploit exists.
VulDB
Oracle Banking Digital Experience 22.1.0/22.2.0 UI General deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Banking Digital Experience 22.1.0/22.2.0 UI General deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
A vulnerability, which was classified as very critical, was found in Oracle Banking Digital Experience 22.1.0/22.2.0. The affected element is an unknown function of the component UI General. Executing a manipulation can lead to deserialization.
This vulnerability is tracked as CVE-2023-46604. The attack can be launched remotely. Moreover, an exploit is present.
VulDB
Oracle Enterprise Data Quality 12.2.1.4.0 General deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Enterprise Data Quality 12.2.1.4.0 General deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
A vulnerability classified as very critical was found in Oracle Enterprise Data Quality 12.2.1.4.0. This affects an unknown function of the component General. The manipulation results in deserialization.
This vulnerability is known as CVE-2023-46604. It is possible to launch the attack remotely. Furthermore, an exploit is available.
VulDB
Apache ActiveMQ/ActiveMQ Legacy OpenWire Module up to 5.15.15/5.16.6/5.17.5/5.18.2 OpenWire Protocol deserialization (ID 175676 / Nessus ID 209676)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Apache ActiveMQ/ActiveMQ Legacy OpenWire Module up to 5.15.15/5.16.6/5.17.5/5.18.2 OpenWire Protocol deserialization (ID 175676 / Nessus ID 209676)
A vulnerability has been found in Apache ActiveMQ and ActiveMQ Legacy OpenWire Module up to 5.15.15/5.16.6/5.17.5/5.18.2 and classified as critical. This affects an unknown part of the component OpenWire Protocol Handler. Performing a manipulation results in deserialization.
This vulnerability is cataloged as CVE-2023-46604. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
The affected component should be upgraded.
VulDB
Oracle Banking APIs 22.1.0/22.2.0 IDM - Authentication deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Banking APIs 22.1.0/22.2.0 IDM - Authentication deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
A vulnerability classified as very critical has been found in Oracle Banking APIs 22.1.0/22.2.0. This vulnerability affects unknown code of the component IDM - Authentication. This manipulation causes deserialization.
The identification of this vulnerability is CVE-2023-46604. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
VulDB
Oracle Communications Element Manager up to 9.0.2.0.1 Security deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Communications Element Manager up to 9.0.2.0.1 Security deserialization (Nessus ID 209676 / WID-SEC-2026-2923)
A vulnerability was found in Oracle Communications Element Manager up to 9.0.2.0.1. It has been rated as very critical. Affected by this issue is some unknown functionality of the component Security. This manipulation causes deserialization.
The identification of this vulnerability is CVE-2023-46604. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
OSV
activemq vulnerabilities
osv·2025-02-14·CVSS 8.8
CVE-2022-41678 [HIGH] activemq vulnerabilities
activemq vulnerabilities
It was discovered that Apache ActiveMQ incorrectly handled
authentication. A remote attacker could possibly use this issue to run
arbitrary code. (CVE-2022-41678)
It was discovered that Apache ActiveMQ incorrectly handled
deserialization. A remote attacker could possibly use this issue to run
arbitrary shell commands. (CVE-2023-46604)
OSV
activemq vulnerabilities
osv·2024-07-23·CVSS 2.7
CVE-2015-7559 [LOW] activemq vulnerabilities
activemq vulnerabilities
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain
commands. A remote attacker could possibly use this issue to terminate
the program, resulting in a denial of service. This issue only affected
Ubuntu 16.04 LTS. (CVE-2015-7559)
Peter Stöckli discovered that Apache ActiveMQ incorrectly handled
hostname verification. A remote attacker could possibly use this issue
to perform a person-in-the-middle attack. This issue only affected Ubuntu
16.04 LTS. (CVE-2018-11775)
Jonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache
ActiveMQ incorrectly handled authentication in certain functions.
A remote attacker could possibly use this issue to perform a
person-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS
OSV
CVE-2023-46604: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution
osv·2023-10-27·CVSS 9.8
CVE-2023-46604 [CRITICAL] CVE-2023-46604: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
OSV
Apache ActiveMQ is vulnerable to Remote Code Execution
osv·2023-10-27
CVE-2023-46604 [CRITICAL] Apache ActiveMQ is vulnerable to Remote Code Execution
Apache ActiveMQ is vulnerable to Remote Code Execution
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
GHSA
Apache ActiveMQ is vulnerable to Remote Code Execution
ghsa·2023-10-27
CVE-2023-46604 [CRITICAL] CWE-502 Apache ActiveMQ is vulnerable to Remote Code Execution
Apache ActiveMQ is vulnerable to Remote Code Execution
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
VulnCheck
GNU C Library Buffer Overflow Vulnerability
vulncheck·2023·CVSS 7.8
CVE-2023-4911 [HIGH] CWE-122 GNU C Library Buffer Overflow Vulnerability
GNU C Library Buffer Overflow Vulnerability
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
Affected: GNU GNU C Library (glibc)
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://blog.aquasec.com/loony-tunables-vulnerability-exploited-by-kinsing; https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/;
VulnCheck
Ignite Realtime Openfire Path Traversal Vulnerability
vulncheck·2023·CVSS 8.6
CVE-2023-32315 [HIGH] CWE-22 Ignite Realtime Openfire Path Traversal Vulnerability
Ignite Realtime Openfire Path Traversal Vulnerability
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
Affected: Ignite Realtime Openfire
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://discourse.igniterealtime.org/uploads/default/original/2X/0/0dbc4f0dafc32fdc198453d385f85af329b1f703.png; https://www.surevine.com/openfire-cve-2023-32315-what-we-know/; https://discourse.igniterealtime.org/t/cve-2023-32315-openfire-administration-console-authentication-bypass/92869/15; https://vulncheck.com/blog/
VulnCheck
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 Unauthenticated Command Execution
vulncheck·2023·CVSS 9.8
CVE-2023-38646 [CRITICAL] Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 Unauthenticated Command Execution
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 Unauthenticated Command Execution
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
Affected: Metabase Metabase
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2023-38646; https://dashboard.shadowserver
VulnCheck
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
vulncheck·2023·CVSS 10.0
CVE-2023-46604 [CRITICAL] CWE-502 Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Affected: Apache ActiveMQ
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://socradar.io/critical-rce-vulnerability-in-apache-activemq-is-targeted-by-hellokitty-ransomware-cve-2023-46604/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.huntress.com
Ubuntu
Apache ActiveMQ vulnerabilities
vendor_ubuntu·2025-02-14·CVSS 8.8
CVE-2023-46604 [HIGH] Apache ActiveMQ vulnerabilities
Title: Apache ActiveMQ vulnerabilities
Summary: Several security issues were fixed in Apache ActiveMQ.
It was discovered that Apache ActiveMQ incorrectly handled
authentication. A remote attacker could possibly use this issue to run
arbitrary code. (CVE-2022-41678)
It was discovered that Apache ActiveMQ incorrectly handled
deserialization. A remote attacker could possibly use this issue to run
arbitrary shell commands. (CVE-2023-46604)
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Siemens Opcenter Intelligence
cisa_ics·2025-02-13
Siemens Opcenter Intelligence
ICS Advisory
##
Siemens Opcenter Intelligence
Release DateFebruary 13, 2025
Alert CodeICSA-25-044-14
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Opcenter Intelligence
- Vulnerabilities: Improper Authentication, Improper Limitation of a Pathname to a Restricted Directory (
Oracle
Oracle Oracle Communications Risk Matrix: Patches (Apache ActiveMQ) — CVE-2023-46604
vendor_oracle·2025-01-15·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Oracle Communications Risk Matrix: Patches (Apache ActiveMQ) — CVE-2023-46604
Oracle Oracle Communications Risk Matrix: Patches (Apache ActiveMQ) vulnerability
CVE: CVE-2023-46604
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Ubuntu
Apache ActiveMQ vulnerabilities
vendor_ubuntu·2024-07-23·CVSS 2.7
CVE-2021-26117 [LOW] Apache ActiveMQ vulnerabilities
Title: Apache ActiveMQ vulnerabilities
Summary: Several security issues were fixed in Apache ActiveMQ.
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain
commands. A remote attacker could possibly use this issue to terminate
the program, resulting in a denial of service. This issue only affected
Ubuntu 16.04 LTS. (CVE-2015-7559)
Peter Stöckli discovered that Apache ActiveMQ incorrectly handled
hostname verification. A remote attacker could possibly use this issue
to perform a person-in-the-middle attack. This issue only affected Ubuntu
16.04 LTS. (CVE-2018-11775)
Jonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache
ActiveMQ incorrectly handled authentication in certain functions.
A remote attacker could possibly use this issue to perform a
person-in-
CISA ICS
Delta Electronics InfraSuite Device Master
cisa_ics·2024-05-09·CVSS 10.0
[CRITICAL] Delta Electronics InfraSuite Device Master
ICS Advisory
##
Delta Electronics InfraSuite Device Master
Release DateMay 09, 2024
Alert CodeICSA-24-130-03
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Delta Electronics
- Equipment: InfraSuite Device Master
- Vulnerability: Deserialization of Untrusted Data
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following Delta Electronics products are affected:
- InfraSuite Device Master: Versions 1.0.10 and prior
## 3.2 Vulnerability Overview
## 3.2.1 Deserialization of Untrusted Data CWE-502
Delta Electronics InfraSuite Device Master contains a deserialization of untrusted data
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Miscellaneous (Apache ActiveMQ) — CVE-2023-46604
vendor_oracle·2024-04-15·CVSS 8.8
CVE-2023-46604 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Miscellaneous (Apache ActiveMQ) — CVE-2023-46604
Oracle Oracle Financial Services Applications Risk Matrix: Miscellaneous (Apache ActiveMQ) vulnerability
CVE: CVE-2023-46604
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Oracle
Oracle Oracle Communications Risk Matrix: Security (Apache ActiveMQ) — CVE-2023-46604
vendor_oracle·2024-01-15·CVSS 9.8
CVE-2023-46604 [CRITICAL] Oracle Oracle Communications Risk Matrix: Security (Apache ActiveMQ) — CVE-2023-46604
Oracle Oracle Communications Risk Matrix: Security (Apache ActiveMQ) vulnerability
CVE: CVE-2023-46604
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
CISA
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
cisa·2023-11-02·CVSS 9.8
CVE-2023-46604 [CRITICAL] CWE-502 Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Vulnerability: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Affected: Apache ActiveMQ
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604
Remediation Due Date: 2023-11-23
Red Hat
activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
vendor_redhat·2023-10-27·CVSS 10.0
CVE-2023-46604 [CRITICAL] CWE-502 activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
A flaw was found in Apache ActiveMQ, specifically the OpenWire Module. This flaw may allow a remote malicious user to run arbitrary shell commands
Debian
CVE-2023-46604: activemq - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. T...
vendor_debian·2023·CVSS 10.0
CVE-2023-46604 [CRITICAL] CVE-2023-46604: activemq - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. T...
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Scope: local
bookworm: resolved (fixed in 5.17.2+dfsg-2+deb12u1)
bullseye: resolved (fixed in 5.16.1-1+deb11u1)
sid: resolved (fixed in 5.17.6+dfsg-1)
trixie: resolved (fixed in 5.17.6+dfsg-1)
Suricata
ET EXPLOIT Successful Apache ActiveMQ Remote Code Execution (CVE-2023-46604)
suricata·2023-11-29·CVSS 10.0
CVE-2023-46604 [CRITICAL] ET EXPLOIT Successful Apache ActiveMQ Remote Code Execution (CVE-2023-46604)
ET EXPLOIT Successful Apache ActiveMQ Remote Code Execution (CVE-2023-46604)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Successful Apache ActiveMQ Remote Code Execution (CVE-2023-46604)"; flow:established,to_client; xbits:isset,ET.CVE-2023-46604.attempt, track ip_dst; http.response_body; content:"|3c|bean"; content:"|22|java|2e|lang|2e|ProcessBuilder|22|"; nocase; fast_pattern; distance:0; content:"init|2d|method|3d 22|start|22|"; within:100; content:"constructor|2d|arg"; distance:0; reference:url,attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604; reference:url,activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; reference:url,github.com/X1r0z/ActiveMQ-RCE; reference:cve,2023-46604; classtype:successful-admin; sid:2049385; rev:1; metadata:a
Suricata
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded
suricata·2023-11-02·CVSS 10.0
CVE-2023-46604 [CRITICAL] ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded"; flow:established,to_client; http.response_body; content:"|3c|bean"; content:"|22|java|2e|lang|2e|ProcessBuilder|22|"; nocase; fast_pattern; distance:0; reference:url,attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604; reference:url,activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; reference:url,github.com/X1r0z/ActiveMQ-RCE; reference:cve,2023-46604; classtype:misc-activity; sid:2049046; rev:2; metadata:attack_target Server, created_at 2023_11_02, deployment Perimeter, performance_impact Low, confidence Low, signature_severity Inf
Suricata
ET EXPLOIT Apache ActiveMQ Remote Code Execution Attempt (CVE-2023-46604)
suricata·2023-11-02·CVSS 10.0
CVE-2023-46604 [CRITICAL] ET EXPLOIT Apache ActiveMQ Remote Code Execution Attempt (CVE-2023-46604)
ET EXPLOIT Apache ActiveMQ Remote Code Execution Attempt (CVE-2023-46604)
Rule: alert tcp any any -> $HOME_NET [61616:61617] (msg:"ET EXPLOIT Apache ActiveMQ Remote Code Execution Attempt (CVE-2023-46604)"; flow:established,to_server; xbits:set,ET.CVE-2023-46604.attempt, track ip_dst, expire 300; stream_size:server,<,500; content:"|01 01|"; content:"org.springframework.context.support.ClassPathXmlApplicationContext|01|"; nocase; within:70; fast_pattern; content:"http"; within:10; content:"|3a 2f 2f|"; within:4; reference:url,attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604; reference:url,activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; reference:url,github.com/X1r0z/ActiveMQ-RCE; reference:cve,2023-46604; classtype:attempted-admin; sid:2049045; rev:2; metadata:
Suricata
ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Remote Instance
suricata·2023-11-01·CVSS 10.0
CVE-2023-46604 [CRITICAL] ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Remote Instance
ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Remote Instance
Rule: alert tcp any any -> $HOME_NET any (msg:"ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Remote Instance"; flow:established,to_client; content:"|01|ActiveMQ"; offset:4; depth:9; fast_pattern; content:"ProviderVersion"; content:"5."; distance:3; within:2; pcre:"/^(?:1(?:(?:4.[012345]|[02].[012]|3.[01234]|1.[0123])|5.(?:[023456789]|1[012345])|6.[0123456]|7.[012345]|8.[012]|.0)|[02678].0|4.[0123]|3.[012]|5.[01]|9.[01])/R"; reference:url,activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; reference:cve,2023-46604; classtype:misc-activity; sid:2049008; rev:2; metadata:attack_target Server, created_at 2023_11_01, cve CVE_2023_46604, deployment Perimeter, deployment
Suricata
ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Local Instance
suricata·2023-11-01·CVSS 10.0
CVE-2023-46604 [CRITICAL] ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Local Instance
ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Local Instance
Rule: alert tcp $HOME_NET any -> any any (msg:"ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Local Instance"; flow:established,to_client; content:"|01|ActiveMQ"; offset:4; depth:9; fast_pattern; content:"ProviderVersion"; content:"5."; distance:3; within:2; pcre:"/^(?:1(?:(?:4.[012345]|[02].[012]|3.[01234]|1.[0123])|5.(?:[023456789]|1[012345])|6.[0123456]|7.[012345]|8.[012]|.0)|[02678].0|4.[0123]|3.[012]|5.[01]|9.[01])/R"; reference:url,activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; reference:cve,2023-46604; classtype:misc-activity; sid:2049009; rev:2; metadata:attack_target Server, created_at 2023_11_01, cve CVE_2023_46604, deployment Perimeter, deployment S
Exploit-DB
Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
exploitdb·2023-04-05·CVSS 8.8
CVE-2022-46604 [HIGH] Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
---
# Exploit Title: Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
# Date: 02-Feb-2023
# Exploit Author: Galoget Latorre (@galoget)
# Vendor Homepage: https://responsivefilemanager.com
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.9.5/responsive_filemanager.zip
# Dockerfile: https://github.com/galoget/ResponsiveFileManager-CVE-2022-46604
# Version: 9.9.5
# Language: Python 3.x
# Tested on:
# - Ubuntu 22.04.5 LTS 64-bit
# - Debian GNU/Linux 10 (buster) 64-bit
# - Kali GNU/Linux 2022.3 64-bit
# CVE: CVE-2022-46604 (Konstantin Burov)
#!/usr/bin/python3
# -*- coding:utf-8 -*-
import sys
import requests
from bs4 import BeautifulSoup
from termcolor import colored, cprint
# Usage
Nuclei
Apache ActiveMQ - Remote Code Execution
nuclei·CVSS 9.8
CVE-2023-46604 [CRITICAL] Apache ActiveMQ - Remote Code Execution
Apache ActiveMQ - Remote Code Execution
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
Template:
id: CVE-2023-46604
info:
name: Apache ActiveMQ - Remote Code Execution
author: Ice3man,Mzack9999,pdresearch
severity: critical
description: |
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in t
Metasploit
Apache ActiveMQ Unauthenticated Remote Code Execution
metasploit
Apache ActiveMQ Unauthenticated Remote Code Execution
Apache ActiveMQ Unauthenticated Remote Code Execution
This module exploits a deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ. Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to 5.16.6, and all versions before 5.15.16.
Securelist
Exploits and vulnerabilities in Q2 2026
blogs_securelist·2026-08-26·CVSS 8.8
CVE-2026-25253 [HIGH] Exploits and vulnerabilities in Q2 2026
Alexander Kolesnikov
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
LLM/AI tool vulnerabilities
Notable vulnerabilities
CVE-2026-25253: a gatewayUrl vulnerability in OpenClaw
CVE-2026-41948: a path traversal vulnerability in the Dify AI platform
CVE-2026-45386: an improper access control vulnerability in Open WebUI
CVE-2026-45501: a vulnerability in Microsoft Exchange
Conclusion and advice
Authors
Alexander Kolesnikov
The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, bot
Securelist
Exploits and vulnerabilities in Q1 2026
blogs_securelist·2026-05-07·CVSS 7.8
CVE-2026-21519 [HIGH] Exploits and vulnerabilities in Q1 2026
Alexander Kolesnikov
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Notable vulnerabilities
CVE-2026-21519: Desktop Window Manager vulnerability
RegPwn (CVE-2026-21533): a system settings access control vulnerability
CVE-2026-21514: a Microsoft Office vulnerability
Clawdbot (CVE-2026-25253): an OpenClaw vulnerability
CVE-2026-34070: LangChain framework vulnerability
CVE-2026-22812: an OpenCode vulnerability
Conclusion and advice
Authors
Alexander Kolesnikov
During Q1 2026, the exploit kits leveraged by threat actors to target user systems expanded once again, incorporating new exploits for the Microsoft Off
Bleepingcomputer
Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
blogs_bleepingcomputer·2026-04-21·CVSS 8.8
CVE-2026-34197 [HIGH] Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
## Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
## Sergiu Gatlan
Nonprofit security organization Shadowserver found that over 6,400 Apache ActiveMQ servers exposed online are vulnerable to ongoing attacks exploiting a high-severity code injection vulnerability.
Apache ActiveMQ is the most popular open-source multi-protocol message broker for asynchronous communication between Java applications.
Tracked as CVE-2026-34197 , the vulnerability was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant after remaining undetected for 13 years .
As Sunkavally explained, this security flaw stems from an improper input validation weakness that enables authenticated threat actors to execute arbitrary code on unpatched systems. The Apache maintainers h
Hackernews
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
blogs_hackernews·2026-04-17·CVSS 8.8
CVE-2026-34197 [HIGH] Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 (CVSS score: 8.8), to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by April 30, 2026.
CVE-2026-34197 has been described as a case of improper input validation that could lead to code injection, eff
Bleepingcomputer
CISA flags Apache ActiveMQ flaw as actively exploited in attacks
blogs_bleepingcomputer·2026-04-17·CVSS 8.8
CVE-2026-34197 [HIGH] CISA flags Apache ActiveMQ flaw as actively exploited in attacks
## CISA flags Apache ActiveMQ flaw as actively exploited in attacks
## Sergiu Gatlan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned on Thursday that a high-severity Apache ActiveMQ vulnerability patched earlier this month is now actively exploited in attacks.
Apache ActiveMQ is the most popular open-source Java-based message broker for asynchronous communication between applications.
Tracked as CVE-2026-34197 , the security flaw has gone undetected for 13 years and was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant.
Sunkavally explained that the vulnerability stems from improper input validation, which allows authenticated threat actors to execute arbitrary code via injection attacks. The Apache maintainers patched the vulner
Bleepingcomputer
13-year-old bug in ActiveMQ lets hackers remotely execute commands
blogs_bleepingcomputer·2026-04-08·CVSS 8.5
CVE-2026-34197 [HIGH] 13-year-old bug in ActiveMQ lets hackers remotely execute commands
## 13-year-old bug in ActiveMQ lets hackers remotely execute commands
## Bill Toulas
This is also the reason why it was missed for more than a decade.
Apache ActiveMQ is an open-source message broker written in Java that handles asynchronous communication via message queues or topics.
Although ActiveMQ has released a newer ‘Artemis’ branch with better performance, the ‘Classic’ edition impacted by CVE-2026-34197 is widely deployed in enterprise, web backends, government, and company systems built on Java.
Horizon3 researcher Naveen Sunkavally found the issue "with nothing more than a couple of basic prompts" in Claude. "This was 80% Claude with 20% gift-wrapping by a human," he said.
Sunkavally notes that Claude pointed to the issue after examining multiple individual components (Jol
Hackernews
Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign
blogs_hackernews·2026-04-07
Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign
An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet.
"A purpose-built Python scanner continuously sweeps major cloud IP ranges for vulnerable targets, automatically installing malicious nodes via ComfyUI-Manager if no exploitable node is already present," Censys security researcher Mark Ellzey said in a report published Monday.
The attack activity, at its core, systemically scans for exposed ComfyUI instances and
Dfir Report
Apache ActiveMQ Exploit Leads to LockBit Ransomware
blogs_dfir_report·2026-02-23·CVSS 10.0
[CRITICAL] Apache ActiveMQ Exploit Leads to LockBit Ransomware
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
Wiz
Crying Out Cloud Newsletter - September 2025 | Wiz
blogs_wiz·2025-09-07·CVSS 8.1
[HIGH] Crying Out Cloud Newsletter - September 2025 | Wiz
Welcome back! In this edition, we bring you the latest in cloud security - noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
## 🔍 Highlights
s1ngularity: Supply Chain Attack Leaks Secrets on GitHub
On August 26, 2025, multiple malicious versions of the widely used Nx build system package were published to the npm registry. These versions contained a post-installation malware script designed to harvest sensitive developer assets, including cryptocurrency wallets, GitHub and npm tokens, SSH keys, and more. The malware leveraged AI command-line tools (including Claude, Gemini, and Q) to aid in their reconnaissance efforts, and then exfiltrated the stolen data to publicly accessible attacker-created repositories within victims’ GitHub accounts.
Learn more in
Fortinet
Old Miner, New Tricks | FortiGuard Labs
blogs_fortinet·2025-07-16
Old Miner, New Tricks | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Old Miner, New Tricks
H2miner Resurfaces with Lcrypt0rx Ransomware
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Adversary Infrastructure & Tool Details
The Curious Case of Lcryx Ransomware
H2Miner Sample Analysis
Script Name: ce.sh
Script Name: spr.sh
Script Name: cpr.sh
Script Name: 1.ps1
Lcrypt0rx Sample Analysis
Script Name: Lcrypt0rx.vbs
Conclusion
Fortinet Protections
IOCs
By Akshat Pradhan | July 16, 2025
Affected Platforms: Linux, Windows, Containers
Impacted Users: Any Organization
Impact: Data Encrypted for Impact, Compute Hijacking, Defacement, Sensitive data stolen.
Severity Level: Critical
The FortiCNAPP team, part of FortiGuard Labs, recently investigated a cluster of virtual private servers (VPS) used for Monero mining. The i
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
Sentinelone
RansomHub
blogs_sentinelone·2025-01-08
RansomHub
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Tenable
Cybersecurity Snapshot: RansomHub Group Triggers CISA Warning, While FBI Says North Korean Hackers Are Targeting Crypto Orgs
blogs_tenable·2024-09-06
Cybersecurity Snapshot: RansomHub Group Triggers CISA Warning, While FBI Says North Korean Hackers Are Targeting Crypto Orgs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Oracle Patch Update, January 2024 Security Update Review
blogs_qualys·2024-01-17
Oracle Patch Update, January 2024 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle has released its first quarterly edition of Critical Patch Update, which contains patches for 389 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in a wide range of product families, including Oracle code and third-party components included in Oracle products.
In the first quarterly Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of patches, 71, constituting 18% of the total patches released. Oracle Communications and Oracle Communications Applications follow
Qualys
Oracle Patch Update, January 2024 Security Update Review | Qualys
blogs_qualys·2024-01-17
Oracle Patch Update, January 2024 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle has released its first quarterly edition of Critical Patch Update, which contains patches for 389 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in a wide range of product families, including Oracle code and third-party components included in Oracle products.
In the first quarterly Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of patches, 71, constituting 18% of the total patches released. Oracle Communications and Oracle Communications Applications
Checkpoint
8th January – Threat Intelligence Report
blogs_checkpoint·2024-01-08
CVE-2023-39336 8th January – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 8th January – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 1st January, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
After ransomware gang INC claimed an attack on Xerox, the company’s subsidiary, Xerox Business Solution (XBS), confirmed having suffered a cyber-attack. Xerox spokesperson said that although personal data from XBS may have been compromised, the attack was contained and did not affect any Xerox corporate systems, data or ope
Wiz
Crying Out Cloud - December Newsletter | Wiz
blogs_wiz·2023-12-01·CVSS 8.8
CVE-2022-4886 [HIGH] Crying Out Cloud - December Newsletter | Wiz
This month introduced vulnerabilities and security incidents that have left users affected. We've curated the most interesting and impactful security highlights for you from the month of November.
Here are our top picks of cloud security highlights!
## 🐞 High Profile Vulnerabilities
High severity vulnerabilities in NGINX Ingress Controller
NGINX ingress controller is affected by 3 high severity vulnerabilities. CVE-2022-4886 allows an attacker who can control the Ingress object itself to steal Kubernetes API credentials, while CVE-2023-5043 and CVE-2023-5044 enable an attacker who can control configuration of the Ingress object to inject arbitrary code and steal credentials from the cluster. As of November 1, 2023, there is no fixed version available. Therefore, users are advised to up
Fortinet
GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ | FortiGuard Labs
blogs_fortinet·2023-11-28·CVSS 10.0
[CRITICAL] GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ
Exploitation
GoTitan
Sliver
PrCtrl Rat
Kinsing
Ddostf
Conclusion
Fortinet Protections
IOCs
IP List
Files
By Cara Lin | November 28, 2023
Affected Platforms: Any OS running Apache Active MQ versions prior to 5.15.16, 5.16.7, 5.17.6, and 5.18.3
Impacted Parties: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
This past October, Apache issued a critical advisory addressing CVE-2023-46604, a vulnerability involving the deserialization of untrusted data in Apache. On November 2, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-46604 to its known exploited list, KEV Catalog, indicating this vulnerability's high risk and im
Trendmicro
Missbrauch von Apache ActiveMQ mit bösen Folgen
blogs_trendmicro·2023-11-23·CVSS 10.0
CVE-2023-46604 [CRITICAL] Missbrauch von Apache ActiveMQ mit bösen Folgen
Ausnutzung von Schwachstellen
## Missbrauch von Apache ActiveMQ mit bösen Folgen
Angreifer nutzen die Apache ActiveMQ Schwachstelle CVE-2023-46604 dazu aus, um Linux-Systeme mit Kinsing und weiterer Malware zu infizieren. Wir zeigen, wie das funktioniert und was dagegen zu tun ist.
By: Peter Girnus Nov 23, 2023 Read time: ( words)
Save to Folio
Wir haben festgestellt, dass die Apache ActiveMQ-Schwachstelle ( CVE-2023-46604 ) aktiv ausgenutzt wird, um Linux-Systeme mit der Kinsing -Malware (auch bekannt als h2miner) und dem entsprechenden Kryptowährungs-Miner zu infizieren.
Seit Anfang November sind mehrere Berichte über aktive Angriffe aufgetaucht. Diese Berichte beziehen sich auf Bedrohungsakteure, die CVE-2023-46604 ausnutzen (z. B. diejenigen, die hinter der HelloKitty-Ransomware-
Bleepingcomputer
CISA orders federal agencies to patch Looney Tunables Linux bug
blogs_bleepingcomputer·2023-11-21
CISA orders federal agencies to patch Looney Tunables Linux bug
## CISA orders federal agencies to patch Looney Tunables Linux bug
## Sergiu Gatlan
Administrators are urged to patch their systems as soon as possible, seeing that the vulnerability is now actively exploited and several proof-of-concept (PoC) exploits have been released online since its disclosure in early October.
"With the capability to provide full root access on popular platforms like Fedora, Ubuntu, and Debian, it's imperative for system administrators to act swiftly," Qualys' Saeed Abbasi warned.
CISA also added the actively exploited Linux flaw to its Known Exploited Vulnerabilities Catalog today, including it in its list of "frequent attack vectors for malicious cyber actors" and posing "significant risks to the federal enterprise."
Following its inclusion in CISA's KEV list,
Trendmicro
CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
blogs_trendmicro·2023-11-20·CVSS 10.0
CVE-2023-46604 [CRITICAL] CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
Exploits & Vulnerabilities
## CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
By: Peter Girnus 2023/11/20 Read time: ( words)
Save to Folio
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner. When exploited, this vulnerability leads to remote code execution (RCE), which Kinsing uses to download and install malware. The vulnerability itself is due to OpenWire commands failing to validate throwable c
Trendmicro
CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
blogs_trendmicro·2023-11-20·CVSS 10.0
CVE-2023-46604 [CRITICAL] CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
Exploits & Vulnerabilities
# CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
By: Peter Girnus
2023/11/20
Read time: ( words)
Save to Folio
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner. When exploited, this vulnerability leads to remote code execution (RCE), which Kinsing uses to download and install malware. The vulnerability itself is due to OpenWire commands failing to validate throwable c
Trendmicro
CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
blogs_trendmicro·2023-11-20·CVSS 10.0
CVE-2023-46604 [CRITICAL] CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
Exploits y vulnerabilidades
## CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
By: Peter Girnus Nov 20, 2023 Read time: ( words)
Save to Folio
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner. When exploited, this vulnerability leads to remote code execution (RCE), which Kinsing uses to download and install malware. The vulnerability itself is due to OpenWire commands failing to validate throwabl
Trendmicro
CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
blogs_trendmicro·2023-11-20·CVSS 10.0
CVE-2023-46604 [CRITICAL] CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
Exploits & Vulnerabilities
## CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
By: Peter Girnus Nov 20, 2023 Read time: ( words)
Save to Folio
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner. When exploited, this vulnerability leads to remote code execution (RCE), which Kinsing uses to download and install malware. The vulnerability itself is due to OpenWire commands failing to validate throwable
Bleepingcomputer
Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits
blogs_bleepingcomputer·2023-11-20·CVSS 10.0
CVE-2023-46604 [CRITICAL] Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits
## Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits
## Bill Toulas
The Kinsing malware operator is actively exploiting the CVE-2023-46604 critical vulnerability in the Apache ActiveMQ open-source message broker to compromise Linux systems.
The flaw allows remote code execution and was fixed in late October. Apache’s disclosure explains that the issue allows running arbitrary shell commands leveraging serialized class types in the OpenWire protocol.
Researchers found that thousands of servers remained exposed to attacks after the release of the patch and ransomware gangs like HelloKitty and TellYouThePass started to take advantage of the opportunity.
## Kinsing targets ActiveMQ
Today, a report from TrendMicro notes that Kinsing adds to the list of threat actors exploitin
Trendmicro
CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
blogs_trendmicro·2023-11-20·CVSS 10.0
CVE-2023-46604 [CRITICAL] CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits
Sfruttamento vulnerabilità
## CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
By: Peter Girnus Nov 20, 2023 Read time: ( words)
Save to Folio
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner. When exploited, this vulnerability leads to remote code execution (RCE), which Kinsing uses to download and install malware. The vulnerability itself is due to OpenWire commands failing to validate throwable
Checkpoint
6th November – Threat Intelligence Report
blogs_checkpoint·2023-11-06
CVE-2023-22518 6th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th November, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Boeing has acknowledged that a cyber-attack had affected its parts and distribution business, and that the company is working with law enforcement to investigate. Earlier this week, ransomware group LockBit has added Boeing to its victim page and claimed to have stolen large amounts of data.
Check Point Harmony Endpoint
Huntress
Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 | Huntress
blogs_huntress·2023-11-02·CVSS 9.8
CVE-2023-46604 [CRITICAL] Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 | Huntress
A partner recently deployed Huntress agents on October 30, 2023, after experiencing a “HelloKitty” ransomware attack on October 27. This ransomware attack followed closely with what was described by Rapid7 in their blog post on November 1, titled Suspected Exploitation of Apache ActiveMQ CVE-2023-46604 .
## What Is CVE-2023-46604?
Rapid7 identified suspected exploitation of Apache ActiveMQ CVE-2023-46604. The CVE is a remote code execution vulnerability. Huntress has already seen this vulnerability being exploited in an environment we monitor. It is imperative you patch your systems immediately.
## Patch Immediately
If you are running Apache ActiveMQ, patches are available to address CVE-2023-46604 for the following versions: 5.15.16, 5.16.7, 5.17.6, and 5.18.3. To determine the versio
Bleepingcomputer
3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online
blogs_bleepingcomputer·2023-11-01·CVSS 10.0
[CRITICAL] 3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online
## 3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online
## Bill Toulas
Over three thousand internet-exposed Apache ActiveMQ servers are vulnerable to a recently disclosed critical remote code execution (RCE) vulnerability.
Apache ActiveMQ is a scalable open-source message broker that fosters communication between clients and servers, supporting Java and various cross-language clients and many protocols, including AMQP, MQTT, OpenWire, and STOMP.
Thanks to the project's support for a diverse set of secure authentication and authorization mechanisms, it is widely used in enterprise environments where systems communicate without direct connectivity.
The flaw in question is CVE-2023-46604 , a critical severity (CVSS v3 score: 10.0) RCE allowing attackers to execute arbit
Sentinelone
RansomHub
blogs_sentinelone
RansomHub
## RansomHub Ransomware: In-Depth Analysis, Detection, and Mitigation
## What Is RansomHub Ransomware?
RansomHub operations were first observed in February of 2024. Since then, the group has drawn heavily upon its ability to recruit and attract operators from other, sometimes imploding, extortion operations. Upon the collapse of ALPHV, for example, multiple affiliates migrated to RansomHub, hoping to monetize their stolen data through them. RansomHub has been associated with the re-extortion of ransomware victims, including high-value healthcare organizations. Primary operators behind RansomHub have openly recruited affiliates from other ransomware operations via their various communication channels, including DLS sites, forum posts, and Telegram.
Operating primarily as a Ransomware-as-
Huntress
CVE-2023-46604 Vulnerability: Analysis, Detection, Removal | Huntress
blogs_huntress·CVSS 9.8
CVE-2023-46604 [CRITICAL] CVE-2023-46604 Vulnerability: Analysis, Detection, Removal | Huntress
## CVE-2023-46604 Vulnerability
Published: 12/16/2025
Written by: Lizzie Danielson
## What is CVE-2023-46604 vulnerability?
CVE-2023-46604 is classified as a Remote Code Execution (RCE) vulnerability affecting Apache ActiveMQ. This vulnerability stems from improper input validation and weak protections around serialized object payloads. Exploiting it enables attackers to execute malicious commands on the target system, potentially leading to complete control. CVSS scoring places this vulnerability in the critical severity range, highlighting its high impact.
## When was it discovered?
Apache disclosed the vulnerability and released new versions of ActiveMQ on October 25, 2023 , during regular product testing. The Apache Foundation issued a public advisory shortly thereafter, includin
Huntress
Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 | Huntress
blogs_huntress·CVSS 9.8
CVE-2023-46604 [CRITICAL] Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 | Huntress
A partner recently deployed Huntress agents on October 30, 2023, after experiencing a “HelloKitty” ransomware attack on October 27. This ransomware attack followed closely with what was described by Rapid7 in their blog post on November 1, titled Suspected Exploitation of Apache ActiveMQ CVE-2023-46604.
## What Is CVE-2023-46604?
Rapid7 identified suspected exploitation of Apache ActiveMQ CVE-2023-46604. The CVE is a remote code execution vulnerability. Huntress has already seen this vulnerability being exploited in an environment we monitor. It is imperative you patch your systems immediately.
## Patch Immediately
If you are running Apache ActiveMQ, patches are available to address CVE-2023-46604 for the following versions: 5.15.16, 5.16.7, 5.17.6, and 5.18.3. To determine the version
arXiv
Efficacy of EPSS in High Severity CVEs found in KEV
arxiv_fulltext·2024-11-04
Efficacy of EPSS in High Severity CVEs found in KEV
empty
empty
24pt
10pt plus 1.0pt minus 2.0pt
## Abstract
The Exploit Prediction Scoring System (EPSS) is designed to assess the probability of a vulnerability being exploited in the next 30 days relative to other vulnerabilities. The latest version, based on a research paper published in arXiv , assists defenders in deciding which vulnerabilities to prioritize for remediation. This study evaluates EPSS's ability to predict exploitation before vulnerabilities are actively compromised, focusing on high severity CVEs that are known to have been exploited and included in the CISA KEV catalog. By analyzing EPSS score history, the availability and simplicity of exploits, the system's purpose, its value as a target for Threat Actors (TAs), this paper examines EPSS's potential and identifies ar
CTF
RumbleInTheJungle / README
ctf_writeups·2024·CVSS 10.0
CVE-2023-46604 [CRITICAL] RumbleInTheJungle / README
# Prime Time (root)
## Challenge
Author: nordbo, tmolberg
> Can you escalate your privileges to root?
> \
> \
> Use the same instance as for Prime time (user)
## Foothold and Shell
The machine was vulnerable to CVE-2023-46604, an exploit targeting Apache ActiveMQ. Using [this exploit](https://github.com/evkl1d/CVE-2023-46604/tree/main), we gained a non-tty shell. For convenience, we added our public keys to `/home/activemq/.ssh/authorized_keys` to enable easier access.
```bash
mkdir -p /home/activemq/.ssh
chmod 700 /home/activemq/.ssh
echo "" > /home/activemq/.ssh/authorized_keys
chmod 600 /home/activemq/.ssh/authorized_keys
```
## Enumeration
Running `sudo -l` revealed the commands that the user `prime` is permitted to execute as root, along with their configurations.
```bash
sud
CTF
[Medium] Data Siege / README
ctf_writeups·2024·CVSS 10.0
[CRITICAL] [Medium] Data Siege / README
Data Siege
07th February 2024 / Document No. D24.102.XX
Prepared By: Nauten, thewildspirit
Challenge Author(s): Nauten
Difficulty: Medium
Classification: Official
# Synopsis
Data siege is a medium forensics challenge involving analyzing the .pcap, understanding that ActiveMQ vulnerability is the entry point, extracting a .NET compiled exe binary, analyzing it, and recovering the information needed to obtain the flag (decrypting the communication between client and server).
## Description
* It was a tranquil night in the Phreaks headquarters, when the entire district erupted in chaos. Unknown assailants, rumored to be a rogue foreign faction, have infiltrated the city's messaging system and critical infrastructure. Garbled transmissions crackle through the airwaves, spewing misinfo
CTF
FesseMisk / README
ctf_writeups·2024·CVSS 10.0
[CRITICAL] FesseMisk / README
# Prime Time (User)
## Description
Cisco Prime Infrastructure is a network management tool for managing network infrastructure. This server is a partial version, containing key components and files for testing, and can be exploited similarly to the full version.
## Solution
Given an IP, we run `nmap -T5 -p- IP` to scan the box. The scan reveals several open ports:
- Port 22: OpenSSH
- Port 1883: MQTT broker
- Port 5672: AMQP service
- Port 8161: HTTP (Jetty 9.2.22, "Apache ActiveMQ" title)
- Port 46655: tcpwrapped
- Port 61613: STOMP protocol
- Port 61614: HTTP (Jetty 9.2.22, supports risky methods)
- Port 61616: Apache ActiveMQ (version 5.15.3)
A quick search for exploits on "Jetty 9.2.22 RCE" and "ActiveMQ 5.15.3 RCE" led to this ActiveMQ exploit: [CVE-2023-46604-ActiveMQ-RCE-pseudo
CTF
munintrollet / README
ctf_writeups·2024
munintrollet / README
## Prime Time (user)
### Challenge
We were given an IP address of a VM.
Nmap scan:
```
# Nmap 7.94SVN scan initiated Sat Nov 2 12:46:58 2024 as: nmap -sC -sV -T5 -p- -oA nmap/scanresult 10.128.3.85
Warning: 10.128.3.85 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.128.3.85
Host is up (0.082s latency).
Not shown: 65527 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
| 2048 14:3e:0f:f2:8b:a9:6d:4e:a9:07:76:0f:ba:89:92:05 (RSA)
| 256 e4:4b:42:a9:72:39:88:fa:01:31:3d:34:49:10:3c:d3 (ECDSA)
|_ 256 f1:99:0c:0d:90:a4:1b:74:9f:e0:b5:95:40:6a:0e:e2 (ED25519)
1883/tcp open mqtt
| mqtt-subscribe:
| Topics and their most recent payloads:
| ActiveMQ/Advisory/MasterBroker:
|_ ActiveMQ/Advisory/Consumer/Topic
CTF
53-kilo-med-data / README
ctf_writeups·2024·CVSS 10.0
[CRITICAL] 53-kilo-med-data / README
# Prime Time (user)
We are given the IP of a machine, and start with a nmap scan to identify which ports are open.
```
$ nmap -T 5 -p- 10.128.2.125 -sV
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-03 00:16 CET
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
1883/tcp open mqtt
5672/tcp open amqp?
8161/tcp open http Jetty 9.2.22.v20170606
39959/tcp open tcpwrapped
61613/tcp open stomp Apache ActiveMQ
61614/tcp open http Jetty 9.2.22.v20170606
61616/tcp open apachemq ActiveMQ OpenWire transport
```
Port 8161 leads to an `ActiveMQ` website, which has links to `/admin` and `/demo`. The demo-endpoint gives a 404, while the admin-endpoint prompts us for login credentials.
The default credentials for ActiveMQ is `admin:admin`, and we can login as admin, howe
CTF
easy / README
ctf_writeups·CVSS 6.0
[MEDIUM] easy / README
---
layout: default
title: Easy Machines
parent: Machines
nav_order: 1
description: "120+ Easy HTB machine writeups with walkthroughs"
permalink: /machines/easy/
---
# HackTheBox Easy Machines - Comprehensive Reference
> Complete catalog of retired HTB Easy machines with OS, key vulnerability, attack path summary, and quality writeup links.
**Total: 100+ Easy Machines** | Updated: April 2026
---
## Quick Navigation
- [Classic / Legacy Machines (2017-2019)](#classic--legacy-machines-2017-2019)
- [2019-2020 Machines](#2019-2020-machines)
- [2021 Machines](#2021-machines)
- [2022 Machines](#2022-machines)
- [2023 Machines](#2023-machines)
- [2024 Machines (Season 4 & 5)](#2024-machines-season-4--5)
- [2025-2026 Machines (Season 6+)](#2025-2026-machines-season-6)
---
## Classic / Legac
CTF
ippsec-video-index
ctf_writeups·CVSS 8.6
[HIGH] ippsec-video-index
# IppSec HTB Video Index - Complete Reference
> The most comprehensive index of IppSec's HackTheBox video walkthroughs.
> Data sourced from [ippsec.rocks](https://ippsec.rocks) dataset, GitHub, and community resources.
> Last updated: 2026-04-10
## Stats
| Category | Count |
|----------|-------|
| HTB Machine Walkthroughs | 432 |
| UHC (Ultimate Hacking Championship) | 12 |
| HTB Sherlocks (DFIR) | 7 |
| VulnHub Machines | 4 |
| Tutorials / Methodology / Special | 61 |
| HTB Academy Modules | 17 |
| **Total Unique Content** | **533** |
| Total Searchable Entries (timestamps) | 9,245 |
## Key Resources
| Resource | URL |
|----------|-----|
| YouTube Channel | [youtube.com/ippsec](https://youtube.com/ippsec) |
| Searchable Video Index | [ippsec.rocks](https://ippsec.rocks) |
| GitHub |
http://seclists.org/fulldisclosure/2024/Apr/18https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txthttps://lists.debian.org/debian-lts-announce/2023/11/msg00013.htmlhttps://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.htmlhttps://security.netapp.com/advisory/ntap-20231110-0010/https://www.openwall.com/lists/oss-security/2023/10/27/5http://seclists.org/fulldisclosure/2024/Apr/18https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txthttps://lists.debian.org/debian-lts-announce/2023/11/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2024/10/msg00027.htmlhttps://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.htmlhttps://security.netapp.com/advisory/ntap-20231110-0010/https://www.openwall.com/lists/oss-security/2023/10/27/5https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604
2023-10-27
Published
2023-11-02
Added to CISA KEV
Exploited in the wild