Apache ActiveMQ/Artemis: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.3
  CVE-2026-27446 EPSS 11%

  Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

  Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an at…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis wildfly-openjdk-21 Ubuntu Wolfi Maven
  Mar 4, 2026
• Medium 5.4
  CVE-2025-66168

  Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated

  WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=C…

  Apache Software Foundation Apache ActiveMQ Apache ActiveMQ MQTT Module Apache ActiveMQ All Module Debian Ubuntu Maven
  Mar 4, 2026

Revision history

1. 2026-09-22 #9

   Neue Updates von Red Hat aufgenommen

2. 2026-08-11 #8

   Neue Updates von Red Hat aufgenommen

3. 2026-07-23 #7

   Neue Updates von IBM aufgenommen

4. 2026-05-18 #6

   Neue Updates von Red Hat aufgenommen

5. 2026-05-14 #5

   Neue Updates von Red Hat aufgenommen

6. 2026-03-24 #4

   Referenz(en) aufgenommen: EUVD-2026-14786

7. 2026-03-05 #3

   Neue Updates von Red Hat aufgenommen

8. 2026-03-04 #2

   Referenz(en) aufgenommen: EUVD-2026-9382, EUVD-2025-208266

9. 2026-03-03 #1

   Initiale Fassung

References

• OSS Security Mailing List vom 2026-03-03
  https://seclists.org/oss-sec/2026/q1/249
• RedHat Customer Portal vom 2026-03-03
  https://access.redhat.com/security/cve/cve-2026-27446
• OSS Security Mailing List vom 2026-03-03
  https://seclists.org/oss-sec/2026/q1/250
• CVE Record vom 2026-03-03
  https://www.cve.org/CVERecord?id=CVE-2025-66168
• Red Hat Security Advisory RHSA-2026:3955 vom 2026-03-05
  https://access.redhat.com/errata/RHSA-2026:3955
• Red Hat Security Advisory RHSA-2026:3957 vom 2026-03-06
  https://access.redhat.com/errata/RHSA-2026:3957
• Red Hat Security Advisory RHSA-2026:17668 vom 2026-05-14
  https://access.redhat.com/errata/RHSA-2026:17668
• Red Hat Security Advisory RHSA-2026:18055 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18055
• Red Hat Security Advisory RHSA-2026:18054 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18054
• Red Hat Security Advisory RHSA-2026:18059 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18059
• IBM Security Bulletin 7280950 vom 2026-07-23
  https://www.ibm.com/support/pages/node/7280950
• Red Hat Security Advisory RHSA-2026:53806 vom 2026-08-11
  https://access.redhat.com/errata/RHSA-2026:53806
• Red Hat Security Advisory RHSA-2026:53644 vom 2026-08-12
  https://access.redhat.com/errata/RHSA-2026:53644
• Red Hat Security Advisory RHSA-2026:70228 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70228