Skip to content
OpenAdvisories
High WID-SEC-2026-3289 7 CVEs

Apache ActiveMQ Artemis: Mehrere Schwachstellen

Published Sep 9, 2026 · Updated Nov 11, 2026 · Revision 6 · de

Vendor: Apache Vendor: NETAPP Vendor: Red Hat Product: ActiveIQ Unified Manager Product: ActiveMQ Product: Enterprise Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ Artemis ausnutzen, um Sicherheitsvorkehrungen zu umgehen, authentifizierte Sitzungen zu kapern, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.

Product

Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-57967 Public exploit

    Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

    An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • Critical 9.1
    CVE-2026-49364

    Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

    An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • Critical 9.1
    CVE-2026-67593

    Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

    A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • High 7.5
    CVE-2026-49362

    Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

    An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Art…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • High 7.5
    CVE-2026-49363

    Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

    An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: fro…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • Medium 6.5
    CVE-2026-57822

    Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

    When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain meth…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • Medium 6.5
    CVE-2026-75880

    Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

    An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apac…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis

Revision history

  1. #6

    Neue Updates von Red Hat aufgenommen

  2. #5

    Neue Updates von NetApp aufgenommen

  3. #4

    Neue Updates von Red Hat aufgenommen

  4. #3

    Neue Updates von Red Hat aufgenommen

  5. #2

    Neue Updates von Red Hat aufgenommen

  6. #1

    Initiale Fassung

References