What is the CVSS score of CVE-2026-49363?

CVE-2026-49363 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache ActiveMQ Artemis are affected by CVE-2026-49363?

Apache ActiveMQ Artemis and Apache Artemis brokers are vulnerable to unauthenticated remote cluster topology disclosure, exposing internal node addresses and cluster membership details to any…

How to fix or mitigate CVE-2026-49363?

Within 24 hours, inventory all Apache Artemis deployments currently in production and assess network exposure by identifying which broker instances accept external CORE protocol connections. Within 7 days, implement compensating controls: restrict CORE protocol port access via firewall rules to authorized internal sources only, enforce broker-level authentication policies, and deploy monitoring for anomalous SUBSCRIBE_TOPOLOGY requests. Within 30 days, monitor Apache security advisories for potential patches, evaluate architectural options to reduce broker exposure, and establish a formal patch and vulnerability management process for Artemis infrastructure.

Apache ActiveMQ Artemis CVE-2026-49363

EUVD-2026-75249 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-09-10

GHSA-68p5-g7wf-vrwp

Authentication Bypass Apache

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable, zero-auth exploit with limited confidentiality impact (topology metadata only); no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 10, 2026 - 02:18 vuln.today

CVE Published

Sep 10, 2026 - 00:41 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 15 New Python Vulnerabilities - 6 Critical, 9 High, 3 With POC Sep 10, 2026

AnalysisAI

Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details to any unauthenticated remote attacker. The CORE protocol's SUBSCRIBE_TOPOLOGY request can be submitted before the broker enforces authentication, leaking cluster node configuration including internal broker addresses and cluster membership data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must have TCP-level network access to the Artemis broker's CORE protocol port. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache ActiveMQ Artemis (or Apache Artemis) version 2.57.0 or later, which resolves the vulnerability by enforcing authentication before processing SUBSCRIBE_TOPOLOGY requests. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Apache Artemis deployments currently in production and assess network exposure by identifying which broker instances accept external CORE protocol connections. …

Threat intelligence, references, and detailed analysis are available after sign-in.