Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions. In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases. Mitigation and Recommendations: Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-19 | 1 | PoC1 |
| 2026-05-20 | 2 | Disclosure1General1 |
| 2026-06-01 | 1 | PoC1 |
CVE-2025-54539: Apache ActiveMQ NMS AMQP Deserialization Policy Bypass to RCE https://blog.securelayer7.net/cve-2025-54539-apache-nms-amqp-rce/
Post summary
The referenced blog post details CVE‑2025‑54539, a deserialization policy bypass in Apache ActiveMQ NMS AMQP that leads to remote code execution, and provides a proof‑of‑concept illustrating the exploit.
ثغرة جديدة في Apache ActiveMQ NMS AMQP تتيح تجاوز سياسات Deserialization والوصول لتنفيذ أوامر عن بُعد RCE. هذا النوع من الثغرات يوسع سطح الهجوم على بيئات الرسائل الحرجة ويتطلب تحديثات عاجلة وضبطًا دقيقًا لسياسات الأمان. CVE-2025-54539 exposes a deserialization policy bypass in Apache ActiveMQ NMS AMQP that can lead to remote code execution. Secure messaging stacks depend on strict deserialization controls, so timely patching and configuration hardening are critical to reducing exposure. https://blog.securelayer7.net/cve-2025-54539-apache-nms-amqp-rce/ #CVE202554539 #ApacheActiveMQ #AppSec
Post summary
The notice announces a newly disclosed CVE-2025-54539 in Apache ActiveMQ NMS AMQP, details a deserialization-bypass RCE vulnerability, and urges timely patching and configuration hardening.
⚡️ Remote Code Execution in Apache NMS AMQP: CVE-2025-54539 Analysis PT ID: PT-2025-42438 The article examines the vulnerability CVE-2025-54539 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2025-54539), which allows remote code execution through unsafe deserialization in the Apache ActiveMQ .NET client library. A flaw in type validation causes malicious objects to be treated as trusted. The author demonstrates how a specially crafted AMQP message can trigger code execution on the client side. As a result, an attacker can compromise systems processing messages without direct access to the server. 📎 Article: https://blog.securelayer7.net/cve-2025-54539-apache-nms-amqp-rce/ #dbugs_attacks
Post summary
The article discloses CVE‑2025‑54539, explaining a remote code execution flaw in Apache ActiveMQ .NET due to unsafe deserialization, and demonstrates a PoC using crafted AMQP messages.
@Dinosn Apache ActiveMQ thought its deserialization policy would save it. CVE-2025-54539 bypasses it entirely via AMQP - straight to RCE. ActiveMQ is the backbone of countless enterprise message brokers. If you're running NMS, this is not theoretical. http://vulntracker.io
Post summary
The tweet highlights that CVE-2025-54539 in Apache ActiveMQ enables remote code execution over AMQP, bypassing the broker’s deserialization policy, and signals a real‑world threat without providing mitigation or exploit details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | activemq_nms_amqp | - | - | - |