CVE-2016-3088

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 98.52%
EPSS Percentile: 99.92%
CISA KEV: YES — Known Exploited Vulnerability

Description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 02-Jun-2016 03:59
Last Modified: 17-Jun-2026 07:44
EPSS Date: 2026-11-04
CWE: CWE-434

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2022-02-10
Remediation Due: 2022-08-10
Known Ransomware Campaign Use: Unknown
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-3088

CNA Products / Version Status

n/a · n/a Source: CNA · [email protected]
Default status: unknown

n/a — affected

Affected Products / Versions

apache / activemq Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.0 · before (exclusive) 5.14.0
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

References

Last enrichment sync: 05-Nov-2026 18:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

brokerConfig=xbean:http:// indicators, noting ActiveMQ has been repeatedly targeted, including past CVE-2016-3088 and CVE-2023-46604 incidents. Actively Exploited Apache ActiveMQ Flaw Affects 6,400 Exposed Servers
Previously, CISA tagged two other Apache ActiveMQ vulnerabilities as exploited in the wild, tracked as CVE-2023-46604 and CVE-2016-3088, with the former targeted by the TellYouThePass ransomware gang as a zero-day flaw. CISA Flags Apache ActiveMQ Flaw CVE-2026-34197 as Actively Exploited
“Both CVE-2016-3088, an authenticated RCE affecting the web console, and CVE-2023-46604, an unauthenticated RCE affecting the broker port, are on CISA’s KEV list.” Apache ActiveMQ Classic flaw enables remote command execution

CVE (3)

People (1)

Threat Actors (1)

MITRE ATT&CK (1)

Vendors (1)

Products (3)

Tools (2)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.