Remote Code Execution in Apache NMS AMQP: CVE-2025-54539 Analysis

The article examines the vulnerability CVE-2025-54539, which allows remote code execution through unsafe deserialization in the Apache ActiveMQ .NET client library. A flaw in type validation causes malicious objects to be treated as trusted.

The author demonstrates how a specially crafted AMQP message can trigger code execution on the client side. As a result, an attacker can compromise systems processing messages without direct access to the server.

📎 Article: https://blog.securelayer7.net/cve-2025-54539-apache-nms-amqp-rce/