Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA Says

An unauthenticated attacker with network access to an Armatura One server (any version before 4.7.2, or before 4.6.1 for the USA build) can trigger deserialization of an arbitrary object graph through the embedded ActiveMQ broker, before authentication is checked. CISA published the advisory, ICSA-26-274-01, on October 1, 2026. Armatura LLC has released fixed builds.

The platform manages physical access control. CISA lists the affected sectors as communications, critical manufacturing, energy and transportation systems, and says exploitation could give an attacker "control of the physical access-control system" along with database access and code execution at the host's highest privilege level.

CVE-2023-46604: an old flaw in a new product

The advisory says Armatura One "embeds Apache ActiveMQ, exposing its OpenWire protocol listener on the network by default." That makes CVE-2023-46604 reachable without credentials. It scores 9.8 on CVSS v3.1 (network vector, low complexity, no privileges, no user interaction).

Apache's own announcement describes a remote attacker with network access to an OpenWire broker or client running arbitrary shell commands. The fixed ActiveMQ releases are 5.15.16, 5.16.7, 5.17.6 and 5.18.3. Neither CISA's advisory nor Apache's tells us which ActiveMQ version Armatura One bundles, so how far behind the product's copy was is unknown.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 2, 2023. The Armatura advisory says it "has been used in ransomware campaigns against other Apache ActiveMQ deployments." The advisory does not report an attack on any Armatura One installation.

The other five flaws, and which scores to trust

CVE	Flaw	CVSS v3.1
CVE-2023-46604	ActiveMQ deserialization, unauthenticated, network	9.8
CVE-2026-94591	Fixed AES-128-CBC key and IV, identical on every install	8.4
CVE-2026-94592	Fixed database superuser password at creation	8.4
CVE-2026-94593	Backup routine logs superuser password in plain text	7.8
CVE-2026-94594	Message broker logs client passwords in plain text	4.0

The score overstates nothing on the first line and understates the combination. The two 8.4 entries carry a local attack vector, so each needs a foothold on the host. Chained with the network-reachable ActiveMQ flaw, that foothold is what the first CVE hands over, and the fixed superuser password and the identical encryption key mean the database credentials need no cracking.

CISA's description of the key flaw is specific: database and message-broker credentials sit in an install configuration file, encrypted with AES-128-CBC "when this protection is enabled," using a key and initialization vector "embedded in the software itself and are identical across every installation."

Fix and mitigation: upgrade to 4.7.2 or 4.6.1_USA

Armatura says it resolved the issues in Armatura One V4.7.2 and, for the USA build, V4.6.1_USA. Users on V4.7.1 or earlier are told to upgrade to V4.7.2. CISA credits Andrew Capobianco of RewCon.co with reporting the flaws.

For operators who cannot upgrade today, CISA's standing advice applies: keep control system devices off the internet, put them behind firewalls and isolate them from business networks, and use a VPN where remote access is required. Blocking the OpenWire listener at the network edge removes the unauthenticated path while the upgrade is scheduled, though the advisory does not list that as a workaround.

Related reading on edge devices exploited early: Citrix NetScaler CVE-2026-88771 and the rsync 3.5.0 Debian bump.