Rule Docs 1:66532

Snort • June 2, 2026

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

SERVER-WEBAPP Apache ActiveMQ ExceptionResponse remote code execution attempt

This rule looks for an ExceptionResponse OpenWire command containing the name of a malicious Java class that when loaded could execute arbitrary commands on the system.

This rule alerts on an insecure deserialization vulnerability in Apache ActiveMQ.

Attacks/Scans seen in the wild

No known false positives

Cisco Talos Intelligence Group

Rule Categories::Server::Web Applications

Rules for detecting attacks against miscellaneous Web applications

MITRE::ATT&CK Framework::Enterprise::Initial Access::Exploit Public-Facing Application

Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.

Vulnerability::Severity::High

Rules that cover vulnerabilities that have CVSS scores of 7.0-9.9 (CVSS V2.0) or 7.0-8.9 (CVSS V3.0 ).

Vulnerability::Severity::Critical

Rules that cover vulnerabilities that have CVSS scores of 10 (CVSS V2.0) or 9.0-10.0 (CVSS V3.0 ).

Insecure Deserialization

Insecure Deserialization relates to web application security. Applications turn an object into data through serialization; the reverse of that process, deserialization, can be vulnerable to attacks when the application trusts the data that is being deserialized. Serialized data is machine readable and not encrypted; serialized user-supplied data should not be trusted. Deserialization attacks can lead to remote code execution.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerabilities in Apache ActiveMQ and OFBiz Detected On June 1 and 2, 2026, Snort published alerts for remote code execution attempts targeting Apache ActiveMQ and Apache OFBiz. The ActiveMQ vulnerability involves insecure deserialization, allowing attackers to execute arbitrary commands via malicious Java classes. The OFBiz vulnerability exploits an unauthenticated URI, leading to potential remote code execution. Both vulnerabilities are categorized as high severity, with no known false positives reported. The attacks are aimed at web-based applications hosted on servers, highlighting the ongoing threat to public-facing applications. Security professionals are advised to monitor for these specific attack vectors and implement necessary defenses. Current status indicates active exploitation attempts in the wild. 6 sources 63

Extracted Entities

Rule Docs 1:66532

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)