Critical Pre-Auth Queue Deletion in Apache ActiveMQ Artemis - CVE-2026-67593

Session hijacking in Apache ActiveMQ Artemis and Apache Artemis allows unauthenticated remote attackers to steal authenticated messaging sessions by sending a crafted CORE protocol SESSION_REATTACH packet, granting full control of an existing authenticated session without any credentials. The CORE protocol's session reattachment mechanism - designed for fault-tolerant HA reconnection - performs no identity verification, enabling any network-accessible attacker to impersonate legitimate connected clients. No public exploit or CISA KEV listing is identified at time of analysis, but the vulnerability spans the entire release history of Apache ActiveMQ Artemis (1.0.0 through 2.44.0), meaning essentially all historical deployments are affected.

Cluster credential exposure in Apache ActiveMQ Artemis and Apache Artemis allows a network-adjacent unauthenticated attacker to passively capture cluster administrative credentials during the initial peer-discovery handshake. Both the legacy Apache ActiveMQ Artemis lineage (versions 1.0.0 through 2.44.0) and the newer Apache Artemis distribution (versions 2.50.0 through 2.56.0) are affected, covering effectively the entire supported history of the project. An attacker positioned on the same network segment as a clustering deployment can intercept these credentials without any prior authentication, then use them to authenticate as a cluster administrator and gain full control over the message broker cluster. No public exploit code has been identified at the time of analysis.

Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details to any unauthenticated remote attacker. The CORE protocol's SUBSCRIBE_TOPOLOGY request can be submitted before the broker enforces authentication, leaking cluster node configuration including internal broker addresses and cluster membership data. No public exploit code has been identified and it is not listed in CISA KEV, but the zero-prerequisite network vector makes automated scanning trivially feasible at scale.

Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis brokers via the native CORE protocol due to missing authentication enforcement in the protocol handler. The vulnerability spans the entire Apache ActiveMQ Artemis release history (1.0.0 through 2.44.0) and the recently rebranded Apache Artemis fork (2.50.0 through 2.56.0), making the unpatched population potentially very large. Exploitation enables persistent unauthorized broker state manipulation and denial-of-service through storage and memory exhaustion, with no credentials or user interaction required; no public exploit code has been identified at time of analysis.

Denial of service in Apache ActiveMQ Artemis and Apache Artemis allows an authenticated client to exhaust shared broker thread resources by attaching a consumer with a crafted wildcard message selector that triggers excessive computational evaluation during message delivery. Affected versions span Apache ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0, with a vendor-confirmed fix released in version 2.57.0 on September 9, 2026. No public exploit code or active exploitation has been identified at time of analysis.

Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.