No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Credit: an anonymous researcher (Trend Micro Zero Day Initiative)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-46604 KEV | CWE-502 Deserialization of Untrusted Data | 9.8 Critical |
Delta Electronics InfraSuite Device Master contains a deserialization of untrusted data vulnerability because it runs a version of Apache ActiveMQ (5.15.2) which is vulnerable to CVE-2023-46604. Mitigation: Delta Electronics states that this issue was fixed by version 1.0.11 released in December 2023. Delta recommends updating to version 1.0.11 or later. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
| Date | Source | Article |
|---|---|---|
| 2026-08-26 | Kaspersky Securelist | Exploits and vulnerabilities in Q2 2026 CVE-2023-46604 |
Articles from the monitored vendor research blogs and security news feeds that reference a CVE cited in this publication, or name the campaign it covers. Coverage begins when feed monitoring started; earlier articles are not indexed.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2023-46604 | 10.0 Critical | Apache ActiveMQ Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run sh… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.