ACTIVELY EXPLOITED
CVE-2023-33246: Apache RocketMQ Command Execution Vulnerability
| Vendor | Apache |
|---|---|
| Product | RocketMQ |
| Actively exploited | Yes |
| Added to CISA KEV | 6 Sep 2023 |
| CISA federal deadline | 27 Sep 2023 |
| Weakness (CWE) | CWE-94 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
SOURCES
Other Apache flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.