CVE-2016-3088 KEVPublic exploit Critical · 9.8 EPSS 98.5%

Apache ActiveMQ Improper Input Validation Vulnerability

Apache · ActiveMQ

Summary

The flaw is an improper input validation issue in the Fileserver web application of Apache ActiveMQ 5.x releases before 5.14.0. An attacker with network access to that web application needs no authentication or user interaction: by sending an HTTP PUT followed by an HTTP MOVE request, they can upload files and execute arbitrary ones.

Official description · NVD

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Breakdown

86.0 / 100

Exploited: Yes, in CISA KEV
Reports: 2
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules
What can follow
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules

First seen exploited 2 years after disclosure. Public exploit code (Exploit-DB) was available 10 months before disclosure.

Public exploit codeExploit-DB17 Aug 201510 mo before
Disclosed1 Jun 2016day 0
First dated threat reportunit42.paloaltonetworks.com17 Sep 2018+2 yrs
First seen exploitedVulnCheck KEV evidence19 Sep 2018+2 yrs
Added to CISA KEVEU database agrees10 Feb 2022+6 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

2 related vulnerabilities in the same code over 9 months. The latest fix listed for activemq-client is 5.15.6.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2015-1830Directory traversal vulnerability in the fileserver…19 Aug 2015
relatedMedium
Why these are linked:
- Same code patched: FilenameGuardFilter.java, index.html (machine-matched)commit 729c473 commit 9fd5cb7 commit 3dd86d0
- Similar weakness in the same product (machine-matched)same package + description similarity
This CVECVE-2016-3088ActiveMQ Improper Input Validation1 Jun 2016KEV

Fixes in activemq-clientMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

5.12.2CVE-2015-52548 Jan 2016
5.13.2CVE-2016-07347 Apr 2016
5.13.2CVE-2016-07825 Aug 2016
5.14.0CVE-2016-30881 Jun 2016KEV
5.14.2CVE-2016-681010 Jan 2018
5.14.5CVE-2015-75591 Aug 2019
5.15.6CVE-2018-1177510 Sep 2018Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 11

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the CVE · uncategorised

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

uploaded files executed, yielding code execution

execute arbitrary files via an HTTP PUT

From the official description (NVD) Original ↗

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Web ShellT1505.003 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2016-3088 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.activemq:activemq-client.

Mavenorg.apache.activemq:activemq-clientGHSA-rxqh-fc23-gxp2

Upgrade to 5.15.16 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2015-1830, CVE-2023-46604).

Set the version to 5.15.16 or later in your pom.xml or build.gradle.

First fixed in 5.14.0 for CVE-2016-3088.

Affected versions

If you run	Upgrade to
5.0.0 up to 5.14.0	5.15.16first fix for this CVE: 5.14.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Named in 2 threat reports

2 reportsCheck PointUnit 42Sep 2018 – Feb 2019

Reports are matched by finding the exact id CVE-2016-3088 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Check Point4 Feb 2019

SpeakUp: A New Undetected Backdoor Linux Trojan

Code Execution (CVE-2018-20062) Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271) Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088)

Original (opens in a new tab) ↗

Unit 4217 Sep 2018

Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

10 links, grouped by NVD tag (9 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 10 Feb 2022. Federal due date 10 Aug 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 10 Feb 2022. EUVD-2022-5255

Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command ExecutionEDB-40857 · remote · windows · 2015-08-17 · verified
ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)EDB-42283 · remote · java · 2017-06-29 · verified

, 30 Oct 2026

98.5%Top 0.08%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.92%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2964 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9992 20.0/20

Threat reports2 reports 6.1/10

Public exploit code1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 advisory exploit reference; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total86.0

Record

Published: 1 Jun 2016
Modified: 17 Jun 2026
: CWE-434 Unrestricted Upload of File with Dangerous TypeCWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What they do

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in activemq-clientMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

SpeakUp: A New Undetected Backdoor Linux Trojan

Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 2

Patch 1

US Government Resource 1

Third Party Advisory 5

Mailing List 1

What they do

What can follow

techniques