What is CVE-2021-26118?

CVE-2021-26118 is a high-severity vulnerability in Apache Artemis, classified under Improper Access Control. CVSS score: 7.5/10. Published 2021-01-27.

How severe is CVE-2021-26118?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Apache Artemis

CVE-2021-26118

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Published 2021-01-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.038 (89.9th percentile), scored 2026-10-20.

Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 89.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.039 · newest: 0.038 · change: -0.001

Affected products

Apache Artemis — versions 2.15.0
Apache Software Foundation Activemq Artemis — versions unspecified
NetApp Oncommand Workflow Automation

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/<CAH+vQmMUNnkiXv2-… (Mailing List, Vendor Advisory)
lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56… (mailing-list)
security.netapp.com/advisory/ntap-20210827-0002/ (Third Party Advisory)

Frequently asked questions

What is CVE-2021-26118?: CVE-2021-26118 is a high-severity vulnerability in Apache Artemis, classified under Improper Access Control. CVSS score: 7.5/10. Published 2021-01-27.
How severe is CVE-2021-26118?: High severity. CVSS v3 base score is 7.5 out of 10.