Apache ActiveMQ
CVE-2016-3088
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconConnect to ActiveMQ web interface
-
DeliverySend HTTP PUT with malicious payload
-
ExploitUpload file to accessible directory
-
InstallIssue HTTP MOVE request
-
C2Relocate file to executable path
-
ExecuteAccess webshell URL
-
ImpactExecute arbitrary code as ActiveMQ user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2021 - Insecure Design
ASVS 5.0
V1 - Architecture, Design and Threat Modeling Secure design patterns, threat modeling
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Apache ActiveMQ 5.x before 5.14.0 where the Fileserver web application component is enabled by default. The vulnerability requires only network access to the ActiveMQ web console port (typically 8161) which is commonly exposed for administrative access. No user interaction, authentication, or non-default configuration is required as indicated by CVSS vector PR:N/UI:N. Organizations that have disabled or removed the Fileserver servlet mapping in web.xml are not exploitable, but this is not a default configuration. |
| Impact | This represents critical real-world risk with convergent high-severity signals across all assessment frameworks. CVSS 9.8 reflects unauthenticated network exploitation (AV:N/AC:L/PR:N/UI:N) with complete system compromise potential. EPSS 94.29% at 100th percentile indicates near-certain exploitation attempts. CISA KEV status confirms active exploitation in production environments. Publicly available exploit code (Exploit-DB 42283) lowers attacker skill requirements to script-kiddie level. SSVC decision framework indicates immediate action required: confirmed exploitation status, automatable attack vector, total technical impact (arbitrary code execution as ActiveMQ process user). The convergence of all risk signals - weaponized exploits, active campaigns, trivial exploitation complexity, and complete compromise potential - makes this a genuine priority requiring immediate remediation regardless of theoretical environmental factors. Zero-day Initiative advisories ZDI-16-356 and ZDI-16-357 provide additional confirmation of exploitability from independent security researchers. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP PUT request to the ActiveMQ Fileserver endpoint (typically /fileserver/) to upload a malicious JSP webshell to a temporary location. The attacker then issues an HTTP MOVE request to relocate the uploaded file into the webapps directory where it becomes executable by the servlet container. The attacker accesses the webshell URL to execute arbitrary commands with ActiveMQ process privileges, enabling data exfiltration from message queues, lateral movement using broker credentials, or full system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 21, 2026
Remote code execution in Apache ActiveMQ 5.x before 5.14.0 allows unauthenticated attackers to upload and execute arbitrary files on the message broker server by chaining HTTP PUT and MOVE requests against the Fileserver web application. This vulnerability is confirmed actively exploited (CISA KEV) with EPSS score of 94.29%, publicly available exploit code exists, and vendor-released patch is available in ActiveMQ 5.14.0.
Earlier versions of this analysis (1)
The Fileserver web application in Apache ActiveMQ allows unauthenticated file upload and execution through sequential HTTP PUT (upload) and MOVE (rename to executable location) requests, enabling trivial remote code execution.
RemediationAI
Upgrade immediately to Apache ActiveMQ 5.14.0 or later, which removes the vulnerable Fileserver web application functionality according to the vendor advisory at http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt and commit thread at https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E. Red Hat customers should apply RHSA-2016-2036 for integrated products. If immediate upgrade is not feasible, disable the Fileserver web application by removing or commenting out the fileserver servlet mapping in the ActiveMQ web.xml configuration file, though this breaks legitimate file transfer functionality. Network segmentation to restrict ActiveMQ admin interface access to trusted management networks provides defense-in-depth but does not eliminate risk if attackers gain internal network access. Do not rely on authentication controls alone as the vulnerability affects unauthenticated endpoints. Given active exploitation and available weaponized exploits, workarounds should be considered temporary emergency measures only pending full upgrade.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache ActiveMQ is an open-source message broker implementing JMS (Java Message Service) for enterprise messaging. The vulnerable Fileserver web application component provides file management capabilities over HTTP. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the application fails to properly validate file uploads and restrict execution permissions. The attack exploits HTTP PUT to write arbitrary files to the server filesystem, then uses HTTP MOVE to relocate them to executable locations like webapps directories, bypassing typical upload restrictions. The affected CPE cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* confirms this impacts the core ActiveMQ product across all platforms prior to version 5.14.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Executive ViewAI
Apache ActiveMQ versions before 5.14.0 are subject to confirmed active exploitation enabling unauthenticated remote code execution on message broker infrastructure. An attacker can execute arbitrary code by uploading and moving files through the web interface, potentially compromising all systems relying on ActiveMQ for message processing and data integrity.
Apply vendor patch. If immediate patching is not feasible, restrict network access to the Fileserver web application component using firewall rules to permit HTTP traffic only from explicitly trusted hosts; disable the Fileserver web application if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
GitHub PoC