EUVD-2026-75249
GHSA-68p5-g7wf-vrwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CORE protocol port
-
DeliverySend pre-auth SUBSCRIBE_TOPOLOGY request
-
ExploitReceive cluster node topology response
-
ExecutionMap internal broker addresses and cluster members
-
ImpactTarget cluster nodes for follow-on attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have TCP-level network access to the Artemis broker's CORE protocol port. No authentication, special configuration, or user interaction is required - the vulnerability is triggered by the default CORE protocol acceptor that is enabled in typical Artemis deployments, simply by sending a SUBSCRIBE_TOPOLOGY request as the first message. Exploitation is limited to information disclosure of cluster node details only; no message content, credentials, or code execution is possible through this path alone. The attack is constrained by network reachability: deployments where the CORE port is firewalled to cluster peers only face substantially reduced real-world risk. |
| Impact | Real-world risk is moderate. The CVSS vector was not provided by the reporter; independently assessed as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (approximately 5.3 Medium), consistent with the Apache Security Team's own 'moderate' severity label. EPSS data is not available for this newly-published CVE. The vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis. The confidentiality impact is limited - only cluster topology/node addresses are disclosed, not message payloads, credentials, or business data - but the information can meaningfully assist a threat actor in mapping internal broker infrastructure for lateral movement or targeted attacks on cluster members. The zero-prerequisite nature (network-reachable CORE port, no auth) means any external or internal host with TCP access to the broker's CORE port can exploit this passively. Organizations exposing Artemis CORE ports externally face higher risk than those with perimeter-restricted deployments. |
| Exploit ScenarioDerived | An attacker with TCP access to the Artemis broker's CORE protocol port opens a raw CORE protocol connection and immediately sends a SUBSCRIBE_TOPOLOGY request without completing the authentication handshake. The broker responds with cluster node details - including internal IP addresses, cluster member names, and connector URIs - before any credentials are checked. The attacker uses this topology map to identify additional broker nodes for targeted follow-on attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details to any unauthenticated remote attacker. The CORE protocol's SUBSCRIBE_TOPOLOGY request can be submitted before the broker enforces authentication, leaking cluster node configuration including internal broker addresses and cluster membership data. No public exploit code has been identified and it is not listed in CISA KEV, but the zero-prerequisite network vector makes automated scanning trivially feasible at scale.
RemediationAI
Upgrade to Apache ActiveMQ Artemis (or Apache Artemis) version 2.57.0 or later, which resolves the vulnerability by enforcing authentication before processing SUBSCRIBE_TOPOLOGY requests. The official advisory is at https://seclists.org/oss-sec/2026/q3/695 and the release is listed at https://artemis.apache.org. For organizations unable to upgrade immediately, a concrete compensating control is to restrict network access to the Artemis CORE protocol port (default TCP 61616 for the OpenWire/CORE multiplex, or a dedicated CORE acceptor port) using firewall rules or security groups so that only trusted broker cluster peers and authorized application hosts can reach it - this eliminates unauthenticated external exposure. If the CORE protocol acceptor is not needed (e.g., broker is accessed only via AMQP or MQTT clients), disabling the CORE acceptor in broker.xml is a viable mitigation with the trade-off of losing native Artemis clustering capabilities.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache ActiveMQ Artemis is a high-performance JMS/AMQP/MQTT/STOMP multi-protocol message broker, widely embedded in Red Hat AMQ and WildFly application servers. The CORE protocol is Artemis's native binary clustering protocol, used for cluster-aware topology propagation between broker nodes. The SUBSCRIBE_TOPOLOGY message type is ordinarily used by cluster members and clients to receive live updates on broker node membership and addresses. The root cause - most closely aligned with CWE-306 (Missing Authentication for Critical Function) - is that the broker's CORE protocol handler services SUBSCRIBE_TOPOLOGY requests before the authentication handshake completes, allowing unauthenticated callers to receive cluster topology responses. The affected Maven coordinates are org.apache.activemq:artemis-server (versions 1.0.0-2.44.0) and the repackaged org.apache.artemis:artemis-server (versions 2.50.0-2.56.0), indicating a namespace/package split at some point in the project history.
Know when Artemis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, zero-auth exploit with limited confidentiality impact (topology metadata only); no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Apache ActiveMQ Artemis and Apache Artemis brokers are vulnerable to unauthenticated remote cluster topology disclosure, exposing internal node addresses and cluster membership details to any attacker with network access. This information disclosure provides threat actors with reconnaissance data necessary to map broker infrastructure and plan targeted follow-on attacks. The vulnerability requires no authentication, user interaction, or specialized exploits, making it a trivial reconnaissance vector for internet-scale scanning operations.
Network segmentation is the primary control: implement strict firewall rules restricting CORE protocol (typically port 61616) access to trusted internal networks only, blocking all external access. Enforce broker-level authentication and authorization policies where available. Deploy network monitoring and alerting on SUBSCRIBE_TOPOLOGY requests from unexpected sources. Segregate Artemis brokers to internal-only networks, restricting exposure until vendor patches are available. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Apache ActiveMQ Artemis Pre-Auth and Auth Flaws
View all 7In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through unc
Unauthenticated remote attackers can exploit Apache ActiveMQ Artemis (2.11.0-2.44.0) and Apache Artemis (2.50.0-2.51.0)
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. Rated high severit
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed thro
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge b
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Ap
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a maliciou
A flaw was found in AMQ Broker. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authent
Exploit-DB