CVE-2023-37582: Apache RocketMQ NameServer incomplete fix allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction required, and very high EPSS probability make this a top remediation priority despite no KEV listing.

What it is

CVE-2023-37582 is a remote command execution flaw in the Apache RocketMQ NameServer component, arising because the fix for CVE-2023-33246 was incomplete in version 5.1.1. When a NameServer address is exposed and lacks permission verification, an attacker can abuse the update configuration function to run commands as the RocketMQ service account.

Impact

An attacker gains arbitrary command execution with the privileges of the RocketMQ system user, which can lead to full compromise of the host and any data or services it can reach.

Attack surface

Reachable over the network via the NameServer component when its address is exposed to the extranet and permission verification is absent; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.904 (99.8th percentile), and references are patch and advisory only with no public exploit tag.

What to do

• Upgrade RocketMQ NameServer to 5.1.2 or above for 5.x, or 4.9.7 or above for 4.x, as the vendor recommends.
• Do not expose NameServer addresses to untrusted networks; restrict access with firewall rules or network segmentation.
• Enable and enforce permission verification on the NameServer component where supported.
• Run RocketMQ under a least-privileged dedicated service account to limit command execution impact.
• Monitor for unexpected configuration changes on NameServer instances.

Detection

• Alert on NameServer update configuration requests originating from unexpected or external source addresses.
• Monitor RocketMQ service account processes for anomalous child processes or command execution.
• Review network logs for external connections to NameServer ports that should be internal only.
• Audit NameServer configuration changes and correlate them with process execution events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.