Apache discloses seven vulnerabilities in Apache Artemis and ActiveMQ Artemis; five rated important, spanning unauthenticated queue creation/deletion, session hijack, credential…
Seven CVEs (CVE-2026-49362, CVE-2026-49363, CVE-2026-49364, CVE-2026-57822, CVE-2026-57967, CVE-2026-67593, CVE-2026-75880) in Apache Artemis and Apache ActiveMQ Artemis were disclosed on 2026-09-10 via oss-security. Unauthenticated attackers can create or…
Seven vulnerabilities affecting Apache Artemis and Apache ActiveMQ Artemis were disclosed on 2026-09-10 via oss-security (reports timestamped 00:39-00:49 UTC), each rated by the Apache Security Team: five important and two moderate. Several allow unauthenticated remote attacks over the CORE protocol. CVE-2026-49362 (important) is a missing authentication check in the CORE protocol handler that lets unauthenticated remote attackers create arbitrary durable queues, enabling unauthorized broker state manipulation and potential denial of service. CVE-2026-49363 (moderate) lets an unauthenticated remote attacker discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request before authentication; impact is limited to topology information disclosure. CVE-2026-57967 (important) is a missing authentication on CORE protocol session reattachment: an unauthenticated remote attacker can craft a SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. CVE-2026-49364 (important) exposes cluster credentials to discovered cluster peers before authentication completes, letting an unauthenticated network-adjacent attacker leverage them. CVE-2026-67593 (important) allows a remote attacker to delete queues via pre-authentication handling of the Openwire protocol. Two flaws require an authenticated client. CVE-2026-57822 (important) is parameter deserialization in message-based management request handling (management-via-messaging) that can trigger broker denial of service; exploitation requires a client authorized with MANAGE permission, and the report's tldr states Apache fixed this issue. CVE-2026-75880 (moderate) lets an authenticated client attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery that occupies a shared broker thread and leads to denial of service. Affected ranges as reported: artemis-server in Apache Artemis 2.50.0-2.56.0 and in ActiveMQ Artemis 1.0.0-2.44.0 for CVE-2026-49362, CVE-2026-49363, and CVE-2026-57967; artemis-core-client and artemis-server spanning ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0 for CVE-2026-49364; artemis-core-client in Apache Artemis 2.50.0-2.56.0 and ActiveMQ Artemis 1.3.0-2.44.0 for CVE-2026-57822; artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0-2.56.0, plus artemis-openwire-protocol 1.0.0-2.44.0 and…
- Seven CVEs in Apache Artemis and Apache ActiveMQ Artemis disclosed 2026-09-10 via oss-security (reports timestamped 00:39-00:49 UTC); five rated important, two moderate, per the Apache Security Team
- CVE-2026-49362 (important): missing authentication in the CORE protocol handler lets unauthenticated remote attackers create arbitrary durable queues, enabling unauthorized broker state manipulation and potential DoS; affects…
- CVE-2026-49363 (moderate): unauthenticated remote attacker can send a pre-authentication CORE SUBSCRIBE_TOPOLOGY request to discover cluster node details; impact limited to topology information disclosure; same artemis-server affected…
- CVE-2026-49364 (important): cluster credentials are exposed to discovered peers before authentication completes; an unauthenticated network-adjacent attacker can leverage them; affects artemis-core-client and artemis-server spanning…
- CVE-2026-57822 (important): parameter deserialization in message-based management requests can trigger broker DoS; requires an authenticated client with MANAGE permission using management-via-messaging; affects artemis-core-client in…
- CVE-2026-57967 (important): missing authentication on CORE session reattachment lets an unauthenticated remote attacker craft a SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously…
- CVE-2026-67593 (important): pre-authentication Openwire protocol handling allows remote queue deletion; affects artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0-2.56.0, artemis-openwire-protocol…
- CVE-2026-75880 (moderate): authenticated client attaches a consumer with crafted selector wildcard usage, causing excessive evaluation that occupies a shared broker thread and leads to DoS; affects artemis-selector 2.50.0-2.56.0 (Artemis)…
Coverage timelineoldest first · each row is one article
- · 6d agoCVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
oss-security· 38
CVE-2026-49362: unauthenticated attackers can create arbitrary durable queues in ActiveMQ Artemis via the CORE protocol, enabling denial of service.
- · 6d agoCVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
CVE-2026-49363 lets unauthenticated attackers subscribe to ActiveMQ Artemis CORE topology and harvest cluster node details pre-authentication.
- · 6d agoCVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
Apache Artemis CVE-2026-49364 exposes cluster credentials to network-adjacent peers discovered before authentication completes.
- · 6d agoCVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service
Apache fixed CVE-2026-57822, a deserialization flaw in ActiveMQ Artemis management messaging letting authorized clients trigger broker denial of service.
- · 6d agoCVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
CVE-2026-57967: unauthenticated attackers can hijack authenticated ActiveMQ Artemis sessions via crafted CORE protocol SESSION_REATTACH packets.
- · 6d agoCVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.
- · 6d agoCVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
CVE-2026-75880: authenticated ActiveMQ Artemis clients can cause denial of service via crafted selector wildcard handling in affected versions.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-57967 | Unauthenticated Session Hijack in Apache ActiveMQ Artemis CORE Protocol CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time. Do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue for both product lines. Until upgraded, restrict network access to the broker's CORE acceptor port (commonly 61616) so only trusted networks and clients can reach it, and review broker logs for unexpected or unexplained session reattachment activity. | 9.8 group max | <1% |
| largetens of thousands of broker deployments worldwide, of which likely only thousands are internet-exposed (order-of-magnitude estimate) |