Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2015-5254

47
FAUCET Score

CVE-2015-5254 is a critical deserialization vulnerability in Apache ActiveMQ 5.x before version 5.13.0, allowing remote attackers to execute arbitrary code. This flaw stems from the broker's failure to restrict serialized classes within Java Message Service (JMS) ObjectMessage objects, impacting various Apache and Red Hat products. With a CVSS score of 9.8 (CRITICAL), it presents a high-risk attack vector (AV:N/AC:L/PR:N/UI:N) leading to complete compromise of confidentiality, integrity, and availability. While no active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB) is reported, its high EPSS score indicates significant exploitability potential, despite minimal community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
2.0CPE matchmatch criteria
cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
5.0.0CPE matchmatch criteria
cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*
5.1.0CPE matchmatch criteria
cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*
5.2.0CPE matchmatch criteria
cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*
5.3.0CPE matchmatch criteria
cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
38.19%
Probability of exploitation in next 30 days
EPSS Percentile
98.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.3819 is in the 96th percentile among its peer group of 36,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (28)

mavenpatch availablevia ghsa
Product: org.apache.activemq:activemq-clientFixed in: 5.12.2
mavenpatch availablevia ghsa
Product: org.apache.activemq:activemq-clientFixed in: 5.11.3
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Fuse 6.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: activemq-0:5.9.0-6.redhat.611454.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: jenkins-0:1.625.3-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-enterprise-upgrade-0:2.2.9-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-broker-util-0:1.37.5.3-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-cartridge-cron-0:1.25.2.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-cartridge-haproxy-0:1.31.5.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-cartridge-mysql-0:1.31.2.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-cartridge-php-0:1.35.3.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-cartridge-python-0:1.34.2.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-msg-node-mcollective-0:1.30.2.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-node-util-0:1.38.6.2-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: php-0:5.3.3-46.el6_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: rhc-0:1.38.6.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: rubygem-openshift-origin-common-0:1.29.5.2-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: rubygem-openshift-origin-console-0:1.35.5.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: rubygem-openshift-origin-controller-0:1.38.5.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: rubygem-openshift-origin-frontend-apache-vhost-0:0.13.2.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: rubygem-openshift-origin-node-0:1.38.5.3-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Enterprise 2.2Fixed in: openshift-origin-node-proxy-0:1.26.2.1-1.el6op
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss A-MQ 6.3
View patch
redhatno patchvia redhat_api
Product: Red Hat JBoss A-MQ 6Fixed in: activemq
redhatno patchvia redhat_api
Product: Red Hat JBoss Fuse 6Fixed in: activemq
redhatno patchvia redhat_api
Product: Red Hat JBoss Fuse Service Works 6.0Fixed in: activemq
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6Fixed in: hornetq
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: artemis

Vendor Advisories (2)

mavenGHSA-q9hr-3pg4-3jp4critical

Improper Input Validation in Apache ActiveMQ

May 13, 2022
redhatCVE-2015-5254Moderate

ObjectMessage: unsafe deserialization

Dec 8, 2015

References

activemq.apache.org / security-advisories.data/CVE-2015-5254-announcement.txt
lists.fedoraproject.org / pipermail/package-announce/2015-December/174371.html
lists.fedoraproject.org / pipermail/package-announce/2015-December/174537.html
rhn.redhat.com / errata/RHSA-2016-0489.html
rhn.redhat.com / errata/RHSA-2016-2035.html
rhn.redhat.com / errata/RHSA-2016-2036.html
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
issues.apache.org / jira/browse/AMQ-6013
Vendor Advisory
lists.apache.org / thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
debian.org / security/2016/dsa-3524
openwall.com / lists/oss-security/2015/12/08/6
oracle.com / technetwork/security-advisory/cpujul2017-3236622.html
oracle.com / technetwork/security-advisory/cpuoct2017-3236626.html