CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1–3 of 3 records

CVE Vendor Product Added Due Status
CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
 Apache ActiveMQ Apr 16, 2026 Apr 30, 2026
CVE-2023-46604 — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
 Apache ActiveMQ Nov 2, 2023 Nov 23, 2023 Ransomware
CVE-2016-3088 — Apache ActiveMQ Improper Input Validation Vulnerability
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
 Apache ActiveMQ Feb 10, 2022 Aug 10, 2022