CVE-2016-3088: Apache ActiveMQ Fileserver unrestricted file upload to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8, KEV listing, near-maximum EPSS probability and public exploit code.

What it is

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 accepts HTTP PUT uploads and HTTP MOVE requests without adequate validation, letting a remote attacker place and then relocate a file into an executable location. Because the uploaded content can be executed, this is a direct path to remote code execution on the broker host.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the ActiveMQ service, leading to full host compromise and potential lateral movement into connected messaging infrastructure.

Attack surface

Reachable over the network via the ActiveMQ Fileserver HTTP endpoint; the CVSS vector shows no privileges or user interaction required. Any deployment exposing the Fileserver web application is directly exposed.

Exploitation

Listed in CISA KEV since 2022-02-10, with an EPSS 30-day probability of 0.985 (99.9th percentile) and a public Exploit-DB entry, indicating active and reliable exploitation. No ransomware campaign use is documented in this record.

What to do

• Upgrade Apache ActiveMQ to 5.14.0 or later, or apply the vendor patch referenced in the Apache advisory.
• If the Fileserver web application is not required, disable or remove it entirely.
• Restrict network access to the ActiveMQ web console and Fileserver ports to trusted management networks only.
• Enforce authentication and authorization on the web console and avoid exposing it to untrusted networks.
• Audit for existing compromise and rotate credentials for the ActiveMQ service account after remediation.

Detection

• Monitor HTTP PUT and MOVE requests to the ActiveMQ Fileserver endpoint, especially PUTs followed by MOVE to executable paths.
• Alert on new or modified files in ActiveMQ web application directories and any process spawned by the ActiveMQ service.
• Review web server and proxy logs for anomalous upload activity from unexpected source addresses.
• Hunt for known exploit artifacts and webshell-like files in ActiveMQ Fileserver directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.