Login Request a demo
High severity · published Sep 10, 2026
CVE-2026-49362
Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache ActiveMQ Artemis · Apache Software Foundation
1.0.0 through 2.44.0 · source: vendor
AA
Apache Artemis · Apache Software Foundation
2.50.0 through 2.56.0 · source: vendor
AR
Artemis · Apache
1.0.0 before 2.44.0; 2.50.0 before 2.57.0 · source: NVD
Affected product
AA
Apache ActiveMQ Artemis
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49362
Mailing List
https://lists.apache.org/thread/3828w4tm5mfpflmoprb5oxfgwhq3xw0v
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/10/1
More from Apache ActiveMQ Artemis
9.8
CVE-2026-57967
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
9.8
CVE-2026-27446
Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
9.1
CVE-2026-49364
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
9.1
CVE-2026-67593
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
7.5
CVE-2026-49363
Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription