CVE-2023-46604: Apache ActiveMQ OpenWire RCE, Embedded in Armatura One (KEV, Ransomware)

CVE-2023-46604 is a deserialization flaw in Apache ActiveMQ's OpenWire marshaller that lets an unauthenticated remote attacker with network access to a broker or client make it instantiate an arbitrary class and run shell commands, it has known ransomware use and sits on the CISA KEV catalog, and CISA's October 2026 advisory for Armatura LLC's "Armatura One" access-control appliance shows the same three-year-old flaw is still reachable today because Armatura One embeds an affected ActiveMQ build with its OpenWire listener exposed on the network by default.

CVE-2023-46604 is a CWE-502 (Deserialization of Untrusted Data) vulnerability in the Java OpenWire protocol marshaller shipped in Apache ActiveMQ. NVD's description states: "This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath," with no authentication required. The Apache ActiveMQ project fixed it in versions 5.15.16, 5.16.7, 5.17.6 and 5.18.3 (NVD; Apache ActiveMQ security advisory).

NVD lists the CVE as Analyzed with a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the Apache Software Foundation's own CNA submission separately scored it 10.0 with a changed-scope vector reflecting that a compromised broker can affect every connected client (NVD).

CISA added CVE-2023-46604 to the Known Exploited Vulnerabilities catalog on 2023-11-02, and the KEV entry records known ransomware campaign use — mass-exploitation campaigns (including HelloKitty and other ransomware affiliates) began hitting internet-facing ActiveMQ brokers within days of the original October 2023 disclosure, using public proof-of-concept code (CISA KEV).

Three years later, CISA's ICS advisory ICSA-26-274-01 (initial release 2026-10-01) for Armatura LLC's "Armatura One" physical access-control platform — deployed worldwide across the Communications, Critical Manufacturing, Energy and Transportation Systems sectors — lists CVE-2023-46604 among its findings and states: "Armatura One embeds Apache ActiveMQ, exposing its OpenWire protocol listener on the network by default. This embedded version is affected by CVE-2023-46604, a deserialization flaw in the OpenWire marshaller that allows an unauthenticated network attacker to trigger deserialization of an arbitrary object graph before authentication is checked." CISA rates the embedded instance the same CVSS v3.1 9.8 and v4.0 9.3 as the original ActiveMQ CVE. Reporter Andrew Capobianco of RewCon.co is credited with reporting the issue to CISA. Remediation differs by release line: "Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2," while "users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA" (CISA ICS Advisory ICSA-26-274-01).

As of 2026-10-29, FIRST scores the probability of exploitation for CVE-2023-46604 at 0.9999 (99.986th percentile) — among the highest EPSS scores possible, consistent with a vulnerability that remains under continuous mass scanning and exploitation more than three years after disclosure (FIRST EPSS).

The Armatura case is a reminder that a fixed upstream CVE does not retire itself: any vendor bundling an old ActiveMQ build inherits the flaw, and any Armatura One deployment, or any other product embedding ActiveMQ before 5.15.16/5.16.7/5.17.6/5.18.3 with the OpenWire port reachable, should be treated as pre-authentication RCE until patched.

• Deserialization flaw in Apache ActiveMQ's OpenWire marshaller lets an unauthenticated remote attacker with network access instantiate an arbitrary class and run shell commands; fixed in 5.15.16, 5.16.7, 5.17.6, 5.18.3. — NVD
• NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
• Added to the CISA KEV catalog on 2023-11-02 with documented known ransomware campaign use. — CISA KEV
• Armatura One access-control appliances embed Apache ActiveMQ with the OpenWire listener exposed by default and are affected by this CVE at CVSS v3.1 9.8; fixed in Armatura One V4.7.2 and Armatura One (USA) V4.6.1_USA. — CISA ICS Advisory ICSA-26-274-01
• EPSS score is 0.9999 (99.986th percentile) as of 2026-10-29. — FIRST EPSS