CVE-2023-46604

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

Published: Oct 27, 2023Updated: Nov 4, 2025 Sources: CVE List NVD GHSA BDU csafCWE-502

10.0CRITICAL

Description

The Tableau Server component in Opcenter Intelligence contains multiple vulnerabilities as described below. Siemens has released a new version for Opcenter Intelligence and recommends to update to the latest version and to install the latest available version of Tableau Server as described in https://support.sw.siemens.com/knowledge-base/PL8822108.

No summary for this CVE yet.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:LConfidentiality

Low

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-502

Affected Products

Apache Software Foundation

oss-project·USaka apache foundation

ActiveMQOn-premDatabase

Databases / cache-message-queue

Apache ActiveMQ

Databases / cache-message-queue

Apache ActiveMQ Legacy OpenWire ModuleOn-premLibrary

OSS Libraries / web-framework

netapp

commercial·US

e-series santricity unified manager

Hardware Firmware

e-series santricity web services proxy

Hardware Firmware

santricity storage plugin

Hardware Firmware

apache

oss-project·USaka apache http server, apache httpd

activemqLibraryLibrary

OSS Libraries / generic-library

activemq legacy openwire moduleOn-premDatabase

Databases / cache-message-queue

Maven

package-ecosystem

org.apache.activemq:activemq-client

OSS Libraries

org.apache.activemq:activemq-openwire-legacy

OSS Libraries

ООО «Ред Софт»

commercial·RUaka red soft

РЕД ОСOn-premOS

Operating Systems / linux-distro

АО «ФЦНИВТ СНПО «Элерон»

СПО «Тобол-ИПК»On-prem

ICS / OT / IoT / industrial-network

and 1 more affected products View all →

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Nov 2, 2023

Remediation due:Nov 23, 2023

Ransomware:Known ransomware use

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Is your org exposed to CVE-2023-46604?We'll check your whole external perimeter for exposure — free. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

3 techniques

Execution

Initial Access

View detailed technique mapping

References

https://cert-portal.siemens.com/productcert/csaf/ssa-246355.json

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-246355.html

cert-portal.siemens.com

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-044-14.json

raw.githubusercontent.com

and 33 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2023-46604 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows