{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:38:01.102Z",
  "tag": {
    "id": "activemq",
    "label": "ActiveMQ",
    "isStack": false,
    "url": "https://pwn.watch/t/activemq",
    "feed": "https://pwn.watch/t/activemq/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "apache-activemq-cve-2026-34197",
      "title": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability",
      "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197",
      "json": "https://pwn.watch/i/apache-activemq-cve-2026-34197.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apache ActiveMQ",
      "tags": [
        "java",
        "apache",
        "activemq",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-34197"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-16",
      "closedAt": "2026-04-16",
      "updatedAt": "2026-04-16",
      "summary": "Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.",
      "xPost": null
    },
    {
      "slug": "apache-activemq-openwire-rce-cve-2023-46604",
      "title": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604",
      "json": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache ActiveMQ (Java OpenWire brokers and clients)",
      "tags": [
        "java",
        "apache",
        "activemq",
        "rce",
        "deserialization",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-46604"
      ],
      "affectedVersions": [
        "See vendor advisory"
      ],
      "fixedVersions": [
        "5.15.16",
        "5.16.7",
        "5.17.6",
        "5.18.3"
      ],
      "startedAt": "2023-10-27",
      "closedAt": "2023-11-02",
      "updatedAt": "2023-11-02",
      "summary": "A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "apache-activemq-cve-2026-34197",
      "incidentTitle": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-16",
      "title": "CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-02",
      "title": "CISA adds CVE-2023-46604 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-01",
      "title": "Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware",
      "body": null,
      "sourceUrl": "https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-27",
      "title": "Apache publishes the CVE-2023-46604 announcement; fixed releases already out",
      "body": null,
      "sourceUrl": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    }
  ]
}