Apache ActiveMQ Artemis CVE-2026-49362

The attacker requires network connectivity to the Apache Artemis broker's CORE protocol acceptor, which listens on TCP 61616 by default and is enabled in standard out-of-the-box deployments. No authentication credentials, sessions, or prior privileges are required - missing authentication in the handler is the root defect. No special broker configuration is needed beyond running a vulnerable version with the default CORE acceptor active. Exploitation is constrained by network reachability: brokers accessible only from internal trusted networks or protected by firewall ACLs blocking TCP 61616 from untrusted sources are not directly exploitable by external attackers. The impact targets durable (persistent) queue creation specifically, meaning the DoS effect persists across broker restarts until the unauthorized queues are manually purged.

The combination of a network attack vector, low attack complexity, no required privileges, and no user interaction places this firmly in the high-severity range despite the lack of a vendor-supplied CVSS vector. The primary impact is availability - an attacker can exhaust broker memory and journal storage through mass durable queue creation - with a secondary integrity dimension since unauthorized persistent queues alter broker configuration state. No EPSS score is available in the input data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. Real-world exposure is strongly gated by network reachability of the CORE protocol port (TCP 61616 by default): brokers behind internal firewalls are substantially protected, though even a mid-sized municipal IT team in tczew running an internet-facing Artemis instance should treat this as urgent given the zero-credential, zero-interaction exploitation path. The breadth of affected versions - the complete 1.x and 2.x lineage through 2.44.0 for ActiveMQ Artemis - means the unpatched footprint is likely substantial across enterprises using the JMS/Jakarta Messaging ecosystem. Apache's own 'important' severity designation is consistent with this assessment.

An external attacker with network access to the broker's TCP 61616 port uses a standard Artemis CORE protocol client to send unauthenticated queue-creation requests in a loop, creating thousands of durable queues that are persisted to the broker's journal storage. The broker continues accepting and processing these requests without requiring any credentials, consuming disk space and memory until the broker becomes degraded or crashes, denying service to all legitimate producers and consumers. No public exploit code is known, but the attack requires only off-the-shelf Artemis client libraries and minimal protocol knowledge.