Critical RCE Flaw CVE-2025-54539 in Apache ActiveMQ NMS AMQP Client Allows Server-Side Code Execution

The article, published on 16 October 2025, reports a critical deserialization vulnerability in Apache ActiveMQ’s NMS AMQP Client, tracked as CVE-2025-54539, that could allow remote code execution on systems connecting to untrusted AMQP servers. According to the Apache advisory, the flaw affects all versions up to and including 2.3.0 of the NMS AMQP Client, a .NET component used to connect applications to ActiveMQ brokers.

Malicious servers could exploit unbounded deserialization logic to craft responses that may execute arbitrary code on client systems and potentially lead to data exfiltration or lateral movement. The vulnerability stems from unsafe deserialization, with a mitigation introduced in version 2.1.0 to restrict deserialization via allow/deny lists, later found to be bypassable under certain conditions, leaving some users exposed.

Apache recommends upgrading immediately to version 2.4.0 or later and migrating away from .NET binary serialization as part of a long-term hardening strategy, while suggesting that organisations limit connections to trusted AMQP brokers and enforce network-level access controls.