Critical Apache ActiveMQ Let Attackers Execute Arbitrary Code

A security flaw in Apache ActiveMQ’s .NET client library can allow remote code execution when the NMS AMQP Client connects to a malicious AMQP server, researchers say. The vulnerability, tracked as CVE-2025-54539, arises from insecure deserialization in the NMS AMQP Client and can enable attackers to run arbitrary code on affected client machines. The issue affects the Apache ActiveMQ NMS AMQP Client up to and including version 2.3.0, with bypasses of existing allow/deny lists noted under specific conditions.

The Apache project rates the severity as Important, and developers are advised to upgrade to version 2.4.0 or later, while also moving away from .NET binary serialization where possible. Mitigations include reviewing broker configurations, using safer serialization frameworks, and enforcing strict type checks, along with network controls to limit access to legitimate broker endpoints. 16 October 2025.