CVE-2016-3088 Apache ActiveMQ
| Affected software | Apache ActiveMQ |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 5.14.0 |
| Weakness | Unrestricted file upload (CWE-434) |
| Published | 1 Jun 2016 |
| Updated | 29 Sep 2026 |
Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CWE-20 · Improper input validation
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-02-10 · remediation due 2022-08-10 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 4 citations · honeypot sightings · 7 exploits · earliest 2018-09-19.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 11 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2015-08-17.
- EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2016-3088 in VulnCheck (free account), which lists 2 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 858 days | 2023-11-14 to 2026-11-12 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 1 day | 2026-10-29 |
| Reported exploitation | tenable.com | /blog/xbash-malware-targets-windows-and-linux-with-ransomware-and-cryptomining | 2018-09-19 |
| Reported exploitation | web.archive.org | /web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf | 2019-09-01 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2022-02-10 |
| Reported exploitation | ivanti.com | /resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3 | 2022-10-21 |
| Exploit reference | VulnCheck XDB 96c75f71a2ee | Exploit type: initial-access | 2020-07-31 |
| Exploit reference | VulnCheck XDB 90020a901ec3 | Exploit type: initial-access | 2020-10-06 |
| Exploit reference | VulnCheck XDB bc5d77bfbacc | Exploit type: remote-with-credentials | 2021-03-11 |
| Exploit reference | VulnCheck XDB 91570066cf0f | Exploit type: remote-with-credentials | 2021-03-12 |
| Exploit reference | VulnCheck XDB b4d788f18d78 | Exploit type: remote-with-credentials | 2021-07-03 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588) | 86 | 2026-04-20 |
| Nuclei | Apache ActiveMQ Fileserver - Arbitrary File Write | ||
| Exploit-DB | ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit) | 2017-06-29 | |
| Metasploit | ActiveMQ web shell upload (excellent rank) | ||
| GitHub PoC | ActiveMQ系列漏洞探测利用工具，包括ActiveMQ 默认口令漏洞及ActiveMQ任意文件写入漏洞（CVE-2016-3088），支持批量探测利用。 | 18 | 2022-04-02 |
| Exploit-DB | Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution | 2015-08-17 | |
| GitHub PoC | ActiveMQ_putshell直接获取webshell | 15 | 2020-07-31 |
| GitHub PoC | Apache ActiveMQ Remote Code Execution Exploit | 5 | 2021-03-11 |
| GitHub PoC | Apache ActiveMQ PUT RCE Scan | 4 | 2021-07-03 |
| GitHub PoC | Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom | 2026-10-08 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full HTTP verb tampering, Filesystem, Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the HTTP Verb Tampering rule, ARMR Filesystem Write, ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: HTTP Verb Tampering rule, ARMR Filesystem Write, ARMR Process rule
ActiveMQ Fileserver PUT+MOVE arbitrary file write (CWE-434). An HTTP Verb Tampering rule that rejects MOVE blocks RestFilter.doMove; a filesystem write rule on webapps, conf and /etc/cron.d blocks the JSP/JAR/cron drop; the Process rule (with /bin/* and /usr/* listed) blocks exec webshells. The Fileserver is disabled by default since 5.12.0.
How to mitigate CVE-2016-3088
Upgrade Apache ActiveMQ to 5.14.0 or later. Until you can, Waratek RASP blocks exploitation with its HTTP verb tampering, filesystem and process rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.activemq:activemq-client |
5.0.0 | 5.14.0 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | activemq | generic | ≥ 5.0.0 and ＜ 5.14.0 |
| osv | org.apache.activemq | activemq-client | generic | ≥ 5.0.0 and ＜ 5.14.0 |
References
Timeline
Timeline
| Published | 2016-06-01 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2018-09-19 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-02-10 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |