EUVD-2026-75248
GHSA-fjwp-v5xg-5q39
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Adjacent-network vector for cluster discovery; unauthenticated pre-auth capture; admin credentials yield full cluster scope change with C/I/A:H impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Cluster credential exposure in Apache ActiveMQ Artemis and Apache Artemis allows a network-adjacent unauthenticated attacker to passively capture cluster administrative credentials during the initial peer-discovery handshake. Both the legacy Apache ActiveMQ Artemis lineage (versions 1.0.0 through 2.44.0) and the newer Apache Artemis distribution (versions 2.50.0 through 2.56.0) are affected, covering effectively the entire supported history of the project. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Clustering must be enabled and actively in use - standalone single-node Artemis deployments that do not use the clustering feature are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is significant despite the absence of a published CVSS vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache Artemis 2.57.0, released September 9, 2026, which resolves the credential exposure in the cluster handshake. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ActiveMQ Artemis and Artemis deployments in production and non-production environments, document cluster configurations, and identify which versions are currently deployed (focus on 1.0.0-2.44.0 and 2.50.0-2.56.0). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through unc
Unauthenticated remote attackers can exploit Apache ActiveMQ Artemis (2.11.0-2.44.0) and Apache Artemis (2.50.0-2.51.0)
Session hijacking in Apache ActiveMQ Artemis and Apache Artemis allows unauthenticated remote attackers to steal authent
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. Rated high severit
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed thro
Pre-authentication queue deletion in Apache Artemis and Apache ActiveMQ Artemis allows unauthenticated remote attackers
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge b
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Ap
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a maliciou
Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details
Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis broke
A flaw was found in AMQ Broker. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authent
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today