Secuno
ENNL
Book demo

CVE-2023-33246

Apache RocketMQ Command Execution

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 96.6%
  1. Published24 May 2023
  2. Added to CISA KEV6 Sept 2023
  3. Remediation due27 Sept 2023
Actively exploited (CISA KEV)

Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

Added to KEV: 6 Sept 2023Federal remediation due: 27 Sept 2023

Description

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.  To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Rocketmq≥ 5.0.0 < 5.1.1 · < 4.9.6

Remediation

Fixed in
Apache Rocketmq≥ 5.1.1

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-185378.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is…
CVE-2026-1093088.8
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request…
CVE-2026-1091998.8
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that…
CVE-2026-4269610.0
Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration…
CVE-2026-398028.1
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13…
CVE-2026-1085989.8
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine…

Frequently asked

Is CVE-2023-33246 being actively exploited?

Yes. CVE-2023-33246 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 6 Sept 2023.

How severe is CVE-2023-33246?

CVE-2023-33246 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 96.6% probability of exploitation.

Which products are affected by CVE-2023-33246?

Affected products include Apache Rocketmq.

How do I fix CVE-2023-33246?

Upgrade affected software to a fixed version, for example Apache Rocketmq 5.1.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-33246 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.