The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote…
Priority CRITICAL 100Exploited in the wildCWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-434.
Summary
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Why it matters now
Exploitation Active In CISA KEV since 2022-02-10CISA due date 2022-08-10
EPSS 0.98365 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial org.apache.activemq:activemq-client (Maven): 5.14.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.activemq:activemq-client (Maven) | 5.0.0 to before 5.14.0 | 5.14.0 | Patch available | GHSA-rxqh-fc23-gxp2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.0.0 to before 5.14.0 Fixed in 5.14.0 Patch available GHSA-rxqh-fc23-gxp2
Remediation
- Fix · GHSA-rxqh-fc23-gxp2 org.apache.activemq:activemq-client (Maven) Fixed in 5.14.0 Advisory →
Red Hat 2 advisories
- RHSA-2016:2036 Released 2016-10-06 · Red Hat rating ImportantRed Hat JBoss A-MQ 6.3 security update
- Red Hat JBoss A-MQ 6.3
- RHSA-2015:1176 Released 2015-06-23 · Red Hat rating ImportantRed Hat JBoss Fuse 6.2.0 update
- Red Hat JBoss Fuse 6.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2016:2036 |
| Red Hat JBoss Fuse 6.2 | Fixed | RHSA-2015:1176 |
Not affected: 2 products
- Red Hat JBoss Fuse Service Works 6
- Red Hat OpenShift Enterprise 2
Timeline
- 2022-02-10 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2016-3088
- 2026-10-03 Alias added: GHSA-rxqh-fc23-gxp2
References
Exploit 1
Advisory 6
- http://www.zerodayinitiative.com/advisories/ZDI-16-356
- http://www.zerodayinitiative.com/advisories/ZDI-16-357
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
- RHSA-2016:2036
- [announce] 20200131 Apache Software Foundation Security Report: 2019
- https://nvd.nist.gov/vuln/detail/CVE-2016-3088
Other 9
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version
- https://github.com/apache/activemq/commit/3dd86d04e8b90ba309819317d19e7260d414d9e7
- https://issues.apache.org/jira/browse/AMQ-6276
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
- https://stackoverflow.com/questions/67140241/configuring-activemq-webconsole-to-redirect-http-to-https
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088
- https://www.exploit-db.com/exploits/42283
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2016-3088 · CVE Program
- CVE-2016-3088 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-rxqh-fc23-gxp2 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-3088 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences