Critical Apache ActiveMQ Vulnerability Let Attackers Execute Arbitrary Code

The Apache Software Foundation has disclosed a critical vulnerability in its ActiveMQ NMS AMQP Client that could allow attackers to execute arbitrary code on vulnerable systems.

Tracked as CVE-2025-54539, this deserialization flaw poses a serious risk to applications relying on the client for messaging over AMQP protocols.

The issue was publicly detailed in an advisory on October 15, 2025, urging immediate upgrades to mitigate potential exploits.

The vulnerability stems from improper handling of untrusted data during connections to AMQP servers. Specifically, in versions up to and including 2.3.0, the client processes unbounded deserialization logic that malicious servers can abuse.

By crafting specially designed responses, attackers could trigger remote code execution on the client side, potentially compromising entire networks or applications.

This deserialization weakness has long been a vector for sophisticated attacks, as it bypasses typical input validation and directly manipulates object states in memory.

Apache ActiveMQ Vulnerability

Efforts to secure the client weren’t foolproof. Starting with version 2.1.0, Apache introduced allow and deny lists to restrict deserialization, aiming to limit what classes could be instantiated from incoming data.

However, security researchers at Endor Labs discovered that these controls could be circumvented under specific conditions, such as through cleverly nested objects or alternative serialization paths.

This bypass effectively nullified the protection, leaving users exposed to the full scope of the flaw. The discovery highlights the challenges in securing legacy serialization mechanisms, especially in .NET environments where binary formats have been a staple.

As .NET 9 deprecates binary serialization a move by Microsoft to curb similar risks Apache is now weighing the complete removal of this support from the NMS API in upcoming releases.

This shift aligns with broader industry trends toward safer alternatives like JSON or Protocol Buffers, reducing the attack surface for deserialization-based exploits.

Mitigations

To address CVE-2025-54539, Apache recommends upgrading to version 2.4.0 or later, where the deserialization logic has been fortified against these attacks.

For projects still tied to .NET binary serialization, migrating to modern formats is essential as a hardening measure.

Organizations using ActiveMQ in distributed systems, such as financial services or IoT infrastructures, should prioritize patching to prevent lateral movement by threat actors.

Discovered by Endor Labs’ Security Research Team, this vulnerability underscores the need for vigilant third-party dependency management.

With a CVSS score indicating important severity, unpatched instances could invite ransomware or data exfiltration.

Developers are advised to scan their supply chains and test connections to external AMQP brokers, ensuring no untrusted endpoints can influence client behavior.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Critical Apache ActiveMQ Vulnerability Let Attackers Execute Arbitrary Code appeared first on Cyber Security News.