Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Apache discloses seven vulnerabilities in Apache Artemis and ActiveMQ Artemis; five rated important, spanning unauthenticated queue creation/deletion, session hijack, credential…

1 source · 7 articlesFirst reported Updated ()4 · 1 read
What's new

Expands the earlier four-advisory story (written 2026-09-10T00:49:35Z) with three additional oss-security advisories published minutes later: CVE-2026-57967 (important), missing authentication on CORE protocol session reattachment allowing unauthenticated session hijack; CVE-2026-67593 (important), pre-authentication Openwire handling allowing remote queue deletion; and CVE-2026-75880 (moderate),…

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

Seven CVEs (CVE-2026-49362, CVE-2026-49363, CVE-2026-49364, CVE-2026-57822, CVE-2026-57967, CVE-2026-67593, CVE-2026-75880) in Apache Artemis and Apache ActiveMQ Artemis were disclosed on 2026-09-10 via oss-security. Unauthenticated attackers can create or…

Seven vulnerabilities affecting Apache Artemis and Apache ActiveMQ Artemis were disclosed on 2026-09-10 via oss-security (reports timestamped 00:39-00:49 UTC), each rated by the Apache Security Team: five important and two moderate. Several allow unauthenticated remote attacks over the CORE protocol. CVE-2026-49362 (important) is a missing authentication check in the CORE protocol handler that lets unauthenticated remote attackers create arbitrary durable queues, enabling unauthorized broker state manipulation and potential denial of service. CVE-2026-49363 (moderate) lets an unauthenticated remote attacker discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request before authentication; impact is limited to topology information disclosure. CVE-2026-57967 (important) is a missing authentication on CORE protocol session reattachment: an unauthenticated remote attacker can craft a SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. CVE-2026-49364 (important) exposes cluster credentials to discovered cluster peers before authentication completes, letting an unauthenticated network-adjacent attacker leverage them. CVE-2026-67593 (important) allows a remote attacker to delete queues via pre-authentication handling of the Openwire protocol. Two flaws require an authenticated client. CVE-2026-57822 (important) is parameter deserialization in message-based management request handling (management-via-messaging) that can trigger broker denial of service; exploitation requires a client authorized with MANAGE permission, and the report's tldr states Apache fixed this issue. CVE-2026-75880 (moderate) lets an authenticated client attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery that occupies a shared broker thread and leads to denial of service. Affected ranges as reported: artemis-server in Apache Artemis 2.50.0-2.56.0 and in ActiveMQ Artemis 1.0.0-2.44.0 for CVE-2026-49362, CVE-2026-49363, and CVE-2026-57967; artemis-core-client and artemis-server spanning ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0 for CVE-2026-49364; artemis-core-client in Apache Artemis 2.50.0-2.56.0 and ActiveMQ Artemis 1.3.0-2.44.0 for CVE-2026-57822; artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0-2.56.0, plus artemis-openwire-protocol 1.0.0-2.44.0 and…

Key facts
  • Seven CVEs in Apache Artemis and Apache ActiveMQ Artemis disclosed 2026-09-10 via oss-security (reports timestamped 00:39-00:49 UTC); five rated important, two moderate, per the Apache Security Team
  • CVE-2026-49362 (important): missing authentication in the CORE protocol handler lets unauthenticated remote attackers create arbitrary durable queues, enabling unauthorized broker state manipulation and potential DoS; affects…
  • CVE-2026-49363 (moderate): unauthenticated remote attacker can send a pre-authentication CORE SUBSCRIBE_TOPOLOGY request to discover cluster node details; impact limited to topology information disclosure; same artemis-server affected…
  • CVE-2026-49364 (important): cluster credentials are exposed to discovered peers before authentication completes; an unauthenticated network-adjacent attacker can leverage them; affects artemis-core-client and artemis-server spanning…
  • CVE-2026-57822 (important): parameter deserialization in message-based management requests can trigger broker DoS; requires an authenticated client with MANAGE permission using management-via-messaging; affects artemis-core-client in…
  • CVE-2026-57967 (important): missing authentication on CORE session reattachment lets an unauthenticated remote attacker craft a SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously…
  • CVE-2026-67593 (important): pre-authentication Openwire protocol handling allows remote queue deletion; affects artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0-2.56.0, artemis-openwire-protocol…
  • CVE-2026-75880 (moderate): authenticated client attaches a consumer with crafted selector wildcard usage, causing excessive evaluation that occupies a shared broker thread and leads to DoS; affects artemis-selector 2.50.0-2.56.0 (Artemis)…
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-67593CVE-2026-57967CVE-2026-49362CVE-2026-57822CVE-2026-49364CVE-2026-75880CVE-2026-49363
Vendors
Apache
Products
Apache ArtemisApache ActiveMQApache ActiveMQ Artemis
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · Sep 10, 2026 oss-securityFirst report

    CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

    CVE-2026-49362: unauthenticated attackers can create arbitrary durable queues in ActiveMQ Artemis via the CORE protocol, enabling denial of service.

  2. · Sep 10, 2026 oss-security

    CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

    CVE-2026-49363 lets unauthenticated attackers subscribe to ActiveMQ Artemis CORE topology and harvest cluster node details pre-authentication.

  3. · Sep 10, 2026 oss-security

    CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

    Apache Artemis CVE-2026-49364 exposes cluster credentials to network-adjacent peers discovered before authentication completes.

  4. · Sep 10, 2026 oss-security

    CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

    Apache fixed CVE-2026-57822, a deserialization flaw in ActiveMQ Artemis management messaging letting authorized clients trigger broker denial of service.

  5. · Sep 10, 2026 oss-security

    CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

    CVE-2026-57967: unauthenticated attackers can hijack authenticated ActiveMQ Artemis sessions via crafted CORE protocol SESSION_REATTACH packets.

  6. · Sep 10, 2026 oss-security

    CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

    CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.

  7. · Sep 10, 2026 oss-security

    CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

    CVE-2026-75880: authenticated ActiveMQ Artemis clients can cause denial of service via crafted selector wildcard handling in affected versions.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-57967
+6 related CVEs
CVE-2026-67593CVE-2026-49364CVE-2026-49363CVE-2026-49362CVE-2026-57822CVE-2026-75880
Unauthenticated Session Hijack in Apache ActiveMQ Artemis CORE Protocol
9.8
group max
1%PoC