Product of Apache

ActiveMQ

As of , 3 Apache ActiveMQ vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 1 was added in 2026. Patch first: CVE-2016-3088.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2016-3088Improper Input ValidationApache ActiveMQPatch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
2CVE-2023-46604Deserialization of Untrusted DataApache ActiveMQPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
3CVE-2026-34197Improper Input ValidationApache ActiveMQPatch this weekMetasploit module0.15

Added each year

0.512022: 1120222023: 1120232024: nonenone20242025: nonenone20252026: 112026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20221
20231
2024none
2025none
20261

Used in ransomware