Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023
Security / news
Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023
CISA's advisory ICSA-26-274-01 lists five flaws, from a pre-authentication code execution hole to a database password that is the same on every install.
An unauthenticated attacker with network access to an Armatura One server can execute code at the highest privilege before any login, because the product embeds an Apache ActiveMQ broker with its OpenWire listener exposed. CISA published the advisory, ICSA-26-274-01, on October 1, 2026. Armatura One is a physical access-control system.
The flaw is CVE-2023-46604, scored 9.8. The CVE number places the ActiveMQ disclosure in 2023, so a 2026 advisory is describing a bug with a public fix.
The five CVEs in ICSA-26-274-01
| CVE | Flaw | CVSS |
|---|---|---|
| CVE-2023-46604 | ActiveMQ OpenWire deserialization, code execution before authentication | 9.8 |
| CVE-2026-94591 | Fixed AES-128-CBC key protects database credentials on every install | 8.4 |
| CVE-2026-94592 | Hardcoded vendor-defined password on the database superuser account | 8.4 |
| CVE-2026-94593 | Backup routines write superuser passwords to plain-text logs | 7.8 |
| CVE-2026-94594 | Message broker logs client credentials in plain text | 4.0 |
- CVE-2023-466049.8 CVSS
- CVE-2026-945918.4 CVSS
- CVE-2026-945928.4 CVSS
- CVE-2026-945937.8 CVSS
- CVE-2026-945944 CVSS
Source: CISA advisory ICSA-26-274-01, accessed 2026-10-04
What Apache fixed and when
Apache's announcement for CVE-2023-46604 says the OpenWire marshaller lets an attacker with network access to a broker or client "instantiate any class on the classpath" through manipulated serialized class types. The fixed ActiveMQ releases are 5.15.16, 5.16.7, 5.17.6 and 5.18.3.
The CISA advisory does not say which ActiveMQ version Armatura One embeds. It says only that the embedded broker is affected. Whether the vendor lagged by months or by years cannot be read from the advisory.
The score understates the other four
The score understates the four Armatura-specific flaws. Three of them are credential problems that need local or file-level access, so their 8.4 and 7.8 ratings look modest next to a 9.8. They are also the ones that make a first foothold worth more.
The fixed AES key matters because the same key sits in every install. Anyone holding the installation package can decrypt stored database credentials, per the advisory. The hardcoded superuser password allows local access if the operator never changed it. Logs that record the superuser password then hand it to anyone who can read a backup log.
The chain is direct: code execution through the broker, then credentials read from logs or decrypted with the shared key, then the database that holds the access-control records.
Affected versions and fix
CISA lists versions before 4.7.2 for the standard build and before 4.6.1 for the USA variant. The fixed releases are Armatura One V4.7.2 and V4.6.1_USA. The advisory also tells operators to contact vendor technical support for guidance.
It credits Andrew Capobianco of RewCon.co with the report and names the Communications, Critical Manufacturing, Energy and Transportation Systems sectors, with worldwide deployment.
The advisory does not claim exploitation in the wild, and nothing in it or in Apache's announcement establishes that Armatura One has been attacked. Operators should upgrade to 4.7.2 or 4.6.1_USA, change the database superuser password, and keep the OpenWire port off any network an untrusted party can reach.
Compare a similar disclosure arc in GitLab's AI Gateway sandbox escape, and see how stored secrets fare in Truffle Security's 543,699-credential count.
Sources
More in Security
- 01Go Team Weighs Turning Off Default MPTCP After Linux FlawThe Go Security Team called a default change premature on Oct. 29, while commenters on golang/go issue 82717 split over keeping multipath TCP on.
- 02Anthropic's Claude Exploit Chains Hit Five Targets, Each With LimitsThe Frontier Red Team's Oct. 27 post covers Chrome, Safari, Android, Windows and Linux, but only the Chrome and Linux results reach code execution.
- 03A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 04Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.