Apache Activemq Artemis (Apache Software Foundation) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-10. Vendor: Apache Software Foundation.
CVEs of Apache Activemq Artemis
- CVE-2026-49362 - CVSS 7.5 (high), 2026-09-10: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential…
- CVE-2026-49363 - CVSS 7.5 (high), 2026-09-10: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to…
- CVE-2026-49364 - CVSS 9.1 (critical), 2026-09-10: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection…
- CVE-2026-57822 - CVSS 6.5 (medium), 2026-09-10: When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to…
- CVE-2026-57967 - CVSS 9.8 (critical), 2026-09-10: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the…
- CVE-2026-67593 - CVSS 9.1 (critical), 2026-09-10: A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection…
- CVE-2026-75880 - CVSS 6.5 (medium), 2026-09-10: An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery…
- CVE-2026-32642 - CVSS 4.3 (medium), 2026-03-24: Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to…
- CVE-2026-27446 - CVSS 9.8 (critical), 2026-03-04: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use…
- CVE-2025-27391 - CVSS 6.8 (medium), 2025-04-09: Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the…
- CVE-2025-27427 - CVSS 4.3 (medium), 2025-04-01: A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the…
- CVE-2023-50780 - CVSS 8.8 (high), 2024-10-14: Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia…
- CVE-2022-35278 - CVSS 6.1 (medium), 2022-08-23: In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML…
- CVE-2022-23913 - CVSS 7.5 (high), 2022-02-04: In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of…
- CVE-2021-26118 - CVSS 7.5 (high), 2021-01-27: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed…
