CVE-2023-46604 Explained: Apache ActiveMQ Remote Code Execution (CVSS 10.0)

Apache ActiveMQ's OpenWire protocol handles binary messages that carry typed Java object payloads. The ClassInfo command type instructs the broker to load and register a class definition — a legitimate feature used for remote class loading in distributed Java environments.

The vulnerability is in how ActiveMQ processes the ClassPathEntry in the ClassInfo command. It constructs an HTTP URL from the attacker-supplied path and performs a remote class load using Java's URL class loader, without validating that the URL points to a trusted or expected source. The loaded class's static initialiser and constructor are executed immediately during class loading, achieving code execution as the ActiveMQ broker process user.

Because the OpenWire port is the broker's primary protocol endpoint — intended to be accessible to all message producers and consumers — it is frequently internet-accessible. This makes the attack remotely exploitable across the public internet with a single crafted binary message.

CVE-2023-46604 was weaponised remarkably quickly. Within 72 hours of the advisory, Rapid7 observed active exploitation attempts. SentinelOne attributed confirmed intrusions using CVE-2023-46604 as initial access to HelloKitty — the ransomware group responsible for the CD Projekt Red breach — deploying both Windows and Linux ransomware variants depending on the target OS.

Kinsing, a prolific cryptomining threat actor known for targeting containerised Linux environments, also deployed cryptominer payloads via CVE-2023-46604. Nation-state actors were also observed in the exploitation wave, reflecting the attractiveness of message broker compromise for persistent internal network access.

ActiveMQ brokers are particularly high-value targets because they typically sit on network segments with broad connectivity — they must communicate with all applications that produce and consume messages, often spanning multiple tiers of the application stack. A compromised broker is a pivot point into the internal network, not just a single system compromise.

The fix is a version upgrade. The interim mitigation is firewall restriction of the OpenWire port.

CVE-2023-46604 is the consequence of exposing a binary protocol with unsafe remote class loading to an untrusted network. Apache ActiveMQ's OpenWire port was designed for application-to-broker communication in trusted internal environments. When organisations expose it to the internet — even accidentally — a CVSS 10.0 attack surface results.

The exploitation timeline is instructive: from advisory to confirmed ransomware deployment, less than one week. Security teams with vulnerable internet-exposed ActiveMQ instances had a very short window to patch before active attacks began. If you run ActiveMQ and did not patch within that window, investigation is the correct first step — not just patching. The patched broker on a previously compromised host still has whatever the attacker installed during their access window.