Port reference
Port 61616 (TCP) – ActiveMQ OpenWire
Default port for OpenWire, the native binary wire protocol of Apache ActiveMQ used by JMS clients to connect to the broker.
Quick facts
- Transport
- tcp
- Category
- Dynamic / private
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
ActiveMQ binds OpenWire on 61616 by default. Exposed brokers may accept default credentials or anonymous clients and, when unpatched, are vulnerable to the CVE-2023-46604 unauthenticated RCE.
What is port 61616 used for?
Port 61616 is the default for OpenWire, the native protocol of Apache ActiveMQ message brokers. It is the main port applications use to publish and consume messages on the broker's queues and topics, typically through JMS clients in Java and other languages. It is separate from ActiveMQ's web admin console on port 8161 and the STOMP connector on 61613; the encrypted variant usually runs on 61617.
When would you open it?
Open it on the internal network so your application servers can connect to the ActiveMQ broker. Keep it bound to a private interface and firewalled to the specific hosts that produce and consume messages. There is normally no reason to expose it to the public internet — remote access should go through a VPN.
Is it safe to open?
Unpatched ActiveMQ has had a critical remote-code-execution flaw on this port, so keep the broker fully updated, use strong credentials, and never expose it publicly. See the security notes below.
How to check if this port is open
ss -tulpn | grep :61616
nmap -p 61616 <target>netstat -ano | findstr :61616
Test-NetConnection <host> -Port 61616lsof -i :61616
nmap -p 61616 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 61616 to your device's local IP, internal port 61616, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 61616/tcpsudo firewall-cmd --permanent --add-port=61616/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 61616 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 61616" -Direction Inbound -Protocol TCP -LocalPort 61616 -Action AllowSecurity & risks
Common attacks
- Unauthenticated remote code execution via CVE-2023-46604
- Login with default admin/admin credentials to control the broker
- Reading and injecting messages on queues and topics
- Pivot from the web console on 8161 to the broker
Hardening
- Patch ActiveMQ to a fixed version to close CVE-2023-46604
- Bind OpenWire to a private interface and firewall 61616 to trusted hosts
- Change default admin/admin credentials and disable anonymous access
- Use OpenWire over TLS (commonly 61617) instead of plaintext 61616
- Apply per-user destination authorization and audit broker access
How to block this port
sudo ufw deny 61616/tcpsudo firewall-cmd --permanent --remove-port=61616/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 61616 -j DROPNew-NetFirewallRule -DisplayName "Block 61616" -Direction Inbound -Protocol TCP -LocalPort 61616 -Action Blocknmap snippet
nmap -p61616 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is CVE-2023-46604?
- CVE-2023-46604 is a critical unauthenticated remote code execution flaw in Apache ActiveMQ's OpenWire protocol on 61616. A crafted packet makes the broker instantiate an attacker-controlled class. Patch immediately and firewall the port.
- What is OpenWire on port 61616?
- OpenWire is ActiveMQ's native binary wire protocol used by JMS clients to connect to the broker on 61616. It carries messages between producers and consumers; the TLS variant typically uses 61617.