Apache Apache Activemq Artemis
15 CVEs affecting Apache Apache Activemq Artemis. Latest disclosed: 2026-09-10. Critical: 4, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57967 | Critical | 9.8 | 2026-09-10 | An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previousl… |
CVE-2026-27446 | Critical | 9.8 | 2026-03-04 | Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the… |
CVE-2026-67593 | Critical | 9.1 | 2026-09-10 | A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authenticat… |
CVE-2026-49364 | Critical | 9.1 | 2026-09-10 | An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handsha… |
CVE-2023-50780 | High | 8.8 | 2024-10-14 | Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint… |
CVE-2026-49363 | High | 7.5 | 2026-09-10 | An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authent… |
CVE-2026-49362 | High | 7.5 | 2026-09-10 | An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential d… |
CVE-2022-23913 | High | 7.5 | 2022-02-04 | In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memor… |
CVE-2021-26118 | High | 7.5 | 2021-01-27 | While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed p… |
CVE-2026-75880 | Medium | 6.5 | 2026-09-10 | An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery… |
CVE-2026-57822 | Medium | 6.5 | 2026-09-10 | When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform… |
CVE-2025-27391 | Medium | 6.5 | 2025-04-09 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apac… |
CVE-2022-35278 | Medium | 6.1 | 2022-08-23 | In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML… |
CVE-2026-32642 | Medium | 4.3 | 2026-03-24 | Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to c… |
CVE-2025-27427 | Medium | 4.3 | 2025-04-01 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the… |