AI analysis
CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.
What to do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue for both product lines. Until upgraded, restrict network access to the broker's CORE acceptor port (commonly 61616) so only trusted networks and clients can reach it, and review broker logs for unexpected or unexplained session reattachment activity.
Affected
| Apache Artemis | 2.50.0 through 2.56.0 (fixed in 2.57.0) |
| Apache ActiveMQ Artemis | 1.0.0 through 2.44.0 (fixed in 2.57.0) |
Estimated exposure
largetens of thousands of broker deployments worldwide, of which likely only thousands are internet-exposed (order-of-magnitude estimate) — No authoritative install counts exist, so this estimate is based on ActiveMQ Artemis's status as a widely deployed open-source JMS message broker in enterprise and embedded middleware stacks, with the CORE port typically reachable only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.