CVE-2026-49362
Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
| CWE | CWE-306 |
| Vendor | apache software foundation |
| Product | apache artemis |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache artemis
Be the first to know when new high vulnerabilities affecting apache software foundation apache artemis are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Artemis
2.50.0 ≤ 2.56.0
Apache Software Foundation / Apache ActiveMQ Artemis
1.0.0 ≤ 2.44.0
References
Credits
Domenico Francesco Bruscino 🔍 Fedrick Sequeira 🔍 Mike Read 🔍 Tiago Ventura