CRITICALCVSS v3.1 9.8Actively exploited · CISA KEV since 2023-09-06Vulnerability
CVE-2023-33246
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Properties
- Euvd product
- Apache RocketMQ
- Vulnerability name
- Apache RocketMQ Command Execution Vulnerability
- First seen
- 2025-10-21T23:05:47+00:00
- Cvss score
- 9.8
- Epss score
- 0.96568
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2023-09-27
- Euvd assigner
- apache
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Exploited euvd since
- 2023-09-06T00:00:00+00:00
- Src batch id
- epss_history-20261020T103617Z-728ddd
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2023-09-06
- Score
- 9.8
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-20T10:36:20+00:00
- Euvd vendor
- Apache Software Foundation
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.8
Related Entities (4)
AFFECTS_PRODUCT (1)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph