CVE-2026-49362

Analyzed Analyzed - Analysis Complete

Unauthenticated Queue Creation in Apache ActiveMQ Artemis

Publication date: 2026-09-10

Last updated on: 2026-09-16

Assigner: Apache Software Foundation

Description

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-16

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-49362

EUVD

EUVD-2026-75250

Affected Vendors & Products

Vendor	Product	Version / Range
apache	artemis	From 2.50.0 (inc) to 2.57.0 (exc)
apache	artemis	From 1.0.0 (inc) to 2.44.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to create arbitrary durable queues via the CORE protocol in Apache Artemis and Apache ActiveMQ Artemis. This can lead to unauthorized manipulation of the broker's state and potential denial of service.

Detection Guidance

Check Apache Artemis or ActiveMQ Artemis versions using commands like 'artemis version' or 'activemq-artemis version'. Monitor for unexpected durable queue creation in logs or via management interfaces.

Impact Analysis

An attacker could exploit this to manipulate the broker's state, disrupt services, or cause a denial of service. Systems using vulnerable versions of Apache Artemis or ActiveMQ Artemis are at risk.

Compliance Impact

This vulnerability allows unauthorized manipulation of broker state and potential denial of service, which could lead to unauthorized access or disruption of data processing systems. This may impact compliance with GDPR by risking unauthorized data access or processing, and with HIPAA by potentially compromising the integrity or availability of protected health information.

Mitigation Strategies

Upgrade to Apache Artemis 2.57.0 or Apache ActiveMQ Artemis 2.45.0 or later immediately. If upgrading is not possible, restrict network access to the CORE protocol port.

Hi! I’m here to help you understand CVE-2026-49362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70