EUVD-2026-75250
GHSA-593h-2v8w-vxpx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-exposed CORE port, no credentials required, no user interaction; primary impact is high-severity DoS via resource exhaustion with limited integrity impact from unauthorized queue creation.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis brokers via the native CORE protocol due to missing authentication enforcement in the protocol handler. The vulnerability spans the entire Apache ActiveMQ Artemis release history (1.0.0 through 2.44.0) and the recently rebranded Apache Artemis fork (2.50.0 through 2.56.0), making the unpatched population potentially very large. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires network connectivity to the Apache Artemis broker's CORE protocol acceptor, which listens on TCP 61616 by default and is enabled in standard out-of-the-box deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The combination of a network attack vector, low attack complexity, no required privileges, and no user interaction places this firmly in the high-severity range despite the lack of a vendor-supplied CVSS vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Artemis version 2.57.0 or later, which resolves the missing authentication check in the CORE protocol handler; this fix applies to both the org.apache.artemis:artemis-server and org.apache.activemq:artemis-server artifacts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Apache Artemis and ActiveMQ Artemis deployments in your environment, document their versions and network exposure, and immediately implement firewall rules restricting access to the CORE protocol port (default 61616) to trusted internal networks only, blocking all external connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today