CVE-2023-46604
Known exploited · CISA KEV
CVSS 10 CRITICAL: the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Nov 23 · date passed
Vulnerabilities & Exploits
CISA says Armatura One has five CVEs, including KEV-listed CVE-2023-46604, and affects versions below 4.7.2 and 4.6.1_USA. The advisory says successful exploitation can expose the database, execute code on the host at highest privilege, or let an attacker control the physical access-control system it manages.
The key detail is that Armatura One ships with Apache ActiveMQ listening on the network by default. That broker can be reached before login is checked, and CVE-2023-46604 lets a network attacker feed it data that gets treated as objects, which can turn into code execution on the host; CISA also says credentials stored in the install config can be recovered and decrypted under CVE-2026-94591.
For operators in communications, manufacturing, energy, and transportation, this is more than an app patch: the hidden broker and the access-control role mean a compromise can cross from software into doors, badges, and other physical controls. The exposure that matters after the fix is any deployment where the product still fronts real-world access systems or bundles other reachable backend services.
1 source · 9h ago
Known exploited · CISA KEV
CVSS 10 CRITICAL: the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Nov 23 · date passed
CISA Advisories
Armatura LLC Armatura One | CISA
Armatura LLC Armatura One Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system.
originalPart of the PlainSec briefing for 2026-10-01
Every edition of this story: Armatura One’s Embedded Broker Widens the Blast Radius