Loading vulnerability details…
CVSS v3.1
N/A
EPSS
38.19%
Published
Jan 8, 2016
Modified
May 6, 2026
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Weaknesses (CWE)
Affected Products (27)
References (20)