CVE-2023-46604: Critical RCE in Java OpenWire Protocol

CVE-2023-46604 is a Remote Code Execution vulnerability in the Java OpenWire protocol marshaller. A remote attacker with network access to a Java-based OpenWire broker or client can manipulate serialized class types in the protocol to instantiate arbitrary classes from the classpath, achieving arbitrary code execution. The specific affected product is not reported in official documentation, but the vulnerability impacts critical communication components based on this protocol.

The vulnerability has a CVSS score of 10.0 and critical severity. It was published on 2023-10-27. Current signals from public repositories indicate that repositories declaring to contain exploit code for this vulnerability have been identified: confirming active attention from the research community on this flaw.

Immediately update OpenWire brokers and clients to the fixed versions: 5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above. Audit your complete inventory for all components using the OpenWire protocol in production across your organization. If immediate patching is not feasible, implement network access restrictions to OpenWire brokers and monitor OpenWire traffic for suspicious activity. Contact your vendors to confirm patch availability and timing.