CVE-2023-33246: Apache RocketMQ Missing Authentication Leads to Remote Command Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with a 9.8 CVSS score, KEV listing, near-certain EPSS probability, and public exploits makes this an urgent patch-first issue.

What it is

RocketMQ 5.1.0 and below expose NameServer, Broker, and Controller components without permission verification, allowing an attacker to abuse the update configuration function to run commands as the RocketMQ system user. The same effect can be achieved by forging RocketMQ protocol content. This is a critical, unauthenticated remote code execution flaw in a widely deployed messaging middleware.

Impact

An attacker gains arbitrary command execution with the privileges of the RocketMQ process, enabling full compromise of the host and any data or credentials it can reach. Because the flaw is unauthenticated and network-reachable, it can be used for lateral movement or ransomware staging.

Attack surface

Reached over the network via exposed RocketMQ NameServer, Broker, or Controller ports; the CVSS vector shows no privileges or user interaction required. Any instance whose components are reachable from an untrusted network is exposed.

Exploitation

CISA added it to KEV on 2023-09-06 with a 2023-09-27 remediation due date, and EPSS gives a 30-day probability of 0.96568 (99.88th percentile). Multiple public exploit references exist, confirming active exploitation.

What to do

• Upgrade to RocketMQ 5.1.1 or above for 5.x, or 4.9.6 or above for 4.x.
• Restrict network access to NameServer, Broker, and Controller ports so they are not reachable from the internet or untrusted segments.
• Enable authentication and ACLs on RocketMQ components where supported, and avoid running them as privileged system users.
• If immediate patching is not possible, apply vendor-recommended mitigations or discontinue use of the affected product per CISA guidance.
• Monitor for unauthorized configuration update requests and forged protocol traffic against RocketMQ endpoints.

Detection

• Alert on unexpected update configuration calls or protocol messages to RocketMQ NameServer, Broker, or Controller ports.
• Monitor RocketMQ process behavior for child processes or shell execution spawned by the service account.
• Review network logs for external or untrusted hosts connecting to RocketMQ ports.
• Audit RocketMQ configuration changes and correlate them with process creation events on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.