$ cve CVE-2016-3088 JSON

CVE-2016-3088 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 98.5% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-08-10.

Description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	98.52% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-434
On CISA KEV	yes — remediate by 2022-08-10
Public exploit	yes
Published	2016-06-01
Last modified	2026-06-17

CISA KEV

Name	Apache ActiveMQ Improper Input Validation Vulnerability
Added	2022-02-10
Due	2022-08-10
Vendor / product	Apache / ActiveMQ
Ransomware use	none reported

Affected (1)

Vendor	Product
apache	activemq

Public exploits

Source	Title	Date
exploit-db	ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)	2017-06-29
exploit-db	Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution	2015-08-17

References

→ the Explorer · watch your stack · NVD