Known Exploited Vulnerabilities September 06, 2023 · CISA KEV Catalog

CVE-2023-33246: Apache RocketMQ Command Execution Vulnerability

Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: Apache CVE-2023-33246
Related: CVE-2016-3081: Apache Struts Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 08, 2026
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Known Exploited Vulnerabilities · Aug 04, 2026
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Apr 16, 2026