Critical Credential Exposure in Apache ActiveMQ Artemis - CVE-2026-49364

Session hijacking in Apache ActiveMQ Artemis and Apache Artemis allows unauthenticated remote attackers to steal authenticated messaging sessions by sending a crafted CORE protocol SESSION_REATTACH packet, granting full control of an existing authenticated session without any credentials. The CORE protocol's session reattachment mechanism - designed for fault-tolerant HA reconnection - performs no identity verification, enabling any network-accessible attacker to impersonate legitimate connected clients. No public exploit or CISA KEV listing is identified at time of analysis, but the vulnerability spans the entire release history of Apache ActiveMQ Artemis (1.0.0 through 2.44.0), meaning essentially all historical deployments are affected.

Pre-authentication queue deletion in Apache Artemis and Apache ActiveMQ Artemis allows unauthenticated remote attackers to destroy message queues by sending a crafted Openwire RemoveSubscriptionInfo command before or after the broker's authentication stage completes. The flaw affects every Apache ActiveMQ Artemis release from 1.0.0 through 2.44.0, and the rebranded Apache Artemis releases from 2.50.0 through 2.56.0, making it an extremely wide-scope exposure for the legacy version range. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low exploitation complexity make this a credible denial-of-service and data-loss vector in any internet- or intranet-exposed Artemis deployment.

Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details to any unauthenticated remote attacker. The CORE protocol's SUBSCRIBE_TOPOLOGY request can be submitted before the broker enforces authentication, leaking cluster node configuration including internal broker addresses and cluster membership data. No public exploit code has been identified and it is not listed in CISA KEV, but the zero-prerequisite network vector makes automated scanning trivially feasible at scale.

Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis brokers via the native CORE protocol due to missing authentication enforcement in the protocol handler. The vulnerability spans the entire Apache ActiveMQ Artemis release history (1.0.0 through 2.44.0) and the recently rebranded Apache Artemis fork (2.50.0 through 2.56.0), making the unpatched population potentially very large. Exploitation enables persistent unauthorized broker state manipulation and denial-of-service through storage and memory exhaustion, with no credentials or user interaction required; no public exploit code has been identified at time of analysis.

Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.

Denial of service in Apache ActiveMQ Artemis and Apache Artemis allows an authenticated client to exhaust shared broker thread resources by attaching a consumer with a crafted wildcard message selector that triggers excessive computational evaluation during message delivery. Affected versions span Apache ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0, with a vendor-confirmed fix released in version 2.57.0 on September 9, 2026. No public exploit code or active exploitation has been identified at time of analysis.