Unauthenticated Session Hijack in Apache ActiveMQ Artemis CORE Protocol
CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.
· Apache Artemis 2.50.0 through 2.56.0 (fixed in 2.57.0) · Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (fixed in 2.57.0)large
Pre-authentication queue deletion in Apache ActiveMQ Artemis via Openwire
CVE-2026-67593 is a missing-authentication flaw (CWE-306) in the Openwire protocol handling of the Apache ActiveMQ Artemis message broker. A remote attacker can send a crafted Openwire RemoveSubscriptionInfo command that causes deletion of a queue on the broker before the connection authentication and authorization stage, or at any time thereafter. Because the command is accepted without authentication, an attacker with network access to the broker's Openwire interface can disrupt messaging operations by deleting queues without any valid credentials. All ActiveMQ Artemis versions from 1.0.0 through 2.44.0 and Artemis versions from 2.50.0 through 2.56.0 are affected, which covers essentially the product's entire version history. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known; the issue is fixed in version 2.57.0.
· Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
Pre-Auth Cluster Credential Exposure in Apache ActiveMQ Artemis Discovery
Apache ActiveMQ Artemis brokers do not enforce authentication for the initial cluster connection handshake (CWE-306, Missing Authentication for Critical Function), so cluster administrative credentials are exchanged without authentication during discovery-driven cluster connections. An unauthenticated, network-adjacent attacker positioned on the same network segment as the brokers can capture these cluster administrative credentials during the handshake. With those credentials, the attacker can gain administrative access to the messaging cluster, compromising broker administration and message flows. Only deployments running affected versions in a clustered configuration that relies on discovery are exposed; this requires the attacker to already have access to the broker network, so internet exposure alone is not the primary risk. No exploitation has been reported, no public proof-of-concept exists, the issue is not in CISA's KEV, and CVSS scoring is pending; version 2.57.0 fixes the flaw.
· Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
Pre-Auth Topology Information Disclosure in Apache ActiveMQ Artemis CORE Protocol
CVE-2026-49363 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache ActiveMQ Artemis/Apache Artemis that allows an unauthenticated remote client to learn cluster topology details. An attacker connects to the broker's CORE acceptor and sends a SUBSCRIBE_TOPOLOGY request before authenticating, receiving cluster node information in response. The disclosure is limited to cluster node details, but it gives outsiders reconnaissance material about the messaging infrastructure that could support targeted follow-on attacks. Any deployment running Apache Artemis 2.50.0-2.56.0 or Apache ActiveMQ Artemis 1.0.0-2.44.0 that accepts untrusted CORE connections is affected, which spans essentially the project's entire release history. There is no public proof-of-concept, no CISA KEV listing, no CVSS score yet, and no known exploitation reported.
· Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
Unauthenticated Queue Creation in Apache ActiveMQ Artemis CORE Protocol
CVE-2026-49362 is a missing-authentication flaw (CWE-306) in the CORE protocol handler of Apache ActiveMQ Artemis and Apache Artemis: the broker accepts CORE protocol commands without requiring any credentials. A remote attacker with network access to the broker's CORE acceptor (the default messaging port) can create arbitrary durable queues without authenticating, manipulating broker state without authorization. Because durable queues persist and consume broker resources, an attacker can repeatedly create queues to exhaust storage or memory and cause a denial of service; the queue creation itself also corrupts the intended broker configuration. All Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis versions 2.50.0 through 2.56.0 are affected. There is no CVSS score yet, no public proof-of-concept, and no known exploitation in the wild; the fix is available in version 2.57.0.
· Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (inclusive) · Apache Artemis 2.50.0 through 2.56.0 (inclusive)large
Authenticated deserialization DoS in Apache ActiveMQ Artemis brokers
When an Apache Artemis or Apache ActiveMQ Artemis broker processes message-based management requests, it deserializes certain method parameters—including ones the broker does not actually use—and the permitted types can be abused to craft a payload that forces excessive computation, pinning the processing thread and causing a denial of service. Triggering the flaw requires an authenticated messaging client that is authorized with the MANAGE permission to perform management-via-messaging, so anonymous or unprivileged clients cannot exploit it. An attacker with such access can repeatedly submit crafted management messages to tie up broker processing capacity, degrading or blocking message handling. Affected deployments run Apache ActiveMQ Artemis 1.3.0 through 2.44.0 or Apache Artemis 2.50.0 through 2.56.0; the fix ships in version 2.57.0. No public proof-of-concept or in-the-wild exploitation is known, and the issue has not yet been scored under CVSS.
· Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.3.0 through 2.44.0large
Authenticated DoS via crafted wildcard message selectors in Apache ActiveMQ Artemis
Apache ActiveMQ Artemis fails to bound the evaluation cost of message selectors, so a selector with crafted wildcard usage can trigger excessive processing (CWE-1333) each time the broker attempts message delivery. An authenticated client triggers it by attaching a consumer whose selector contains the crafted wildcards, and each delivery attempt then occupies a shared broker thread for a disproportionate amount of time. By sustaining this load (with one or more such consumers), the attacker can tie up broker threads and stall or degrade message delivery for other clients, achieving denial of service with no privilege escalation or data exposure. All users running Apache Artemis 2.50.0 through 2.56.0 or Apache ActiveMQ Artemis 1.0.0 through 2.44.0 are affected, which in practice covers essentially every Artemis release before 2.57.0 across standalone and embedded broker deployments. The flaw has no CVSS score yet, no known public proof-of-concept, is not listed in CISA KEV, and there are no known reports of exploitation in the wild.
· Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large