CVE-2026-49364

Analyzed Analyzed - Analysis Complete

Unauthenticated Credential Exposure in Apache ActiveMQ Artemis

Publication date: 2026-09-10

Last updated on: 2026-09-16

Assigner: Apache Software Foundation

Description

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-16

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-49364

EUVD

EUVD-2026-75248

Affected Vendors & Products

Vendor	Product	Version / Range
apache	artemis	From 2.50.0 (inc) to 2.57.0 (exc)
apache	artemis	From 1.0.0 (inc) to 2.44.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker on the same network to capture cluster administrative credentials during the initial connection setup of Apache Artemis or ActiveMQ Artemis. It specifically targets the discovery process in versions 2.50.0 through 2.56.0 for Artemis and 1.0.0 through 2.44.0 for ActiveMQ Artemis.

Detection Guidance

This vulnerability involves capturing cluster administrative credentials during the initial cluster connection handshake. Detection may require monitoring network traffic for suspicious discovery handshakes or credential exchanges in Apache Artemis or ActiveMQ Artemis versions 2.50.0 through 2.56.0 or 1.0.0 through 2.44.0.

Impact Analysis

An attacker could gain administrative access to the cluster, allowing them to read, modify, or delete sensitive data, disrupt services, or launch further attacks within the affected system.

Compliance Impact

This vulnerability could lead to unauthorized access to administrative credentials, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized data access or breaches.

Mitigation Strategies

Upgrade Apache Artemis to version 2.57.0 or later and Apache ActiveMQ Artemis to version 2.45.0 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-49364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70