ACTIVELY EXPLOITED
CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability
| Vendor | Apache |
|---|---|
| Product | ActiveMQ |
| Actively exploited | Yes |
| Added to CISA KEV | 10 Feb 2022 |
| CISA federal deadline | 10 Aug 2022 |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
SOURCES
Other Apache flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.