Apache ActiveMQ Artemis CVE-2026-49364

Clustering must be enabled and actively in use - standalone single-node Artemis deployments that do not use the clustering feature are not exposed. The attacker must be network-adjacent: positioned on the same broadcast domain, multicast-reachable segment, or cloud subnet as at least one broker node. No authentication to the broker is required. No special user interaction or non-default configuration beyond enabling clustering is needed. Exploitation is limited by the adjacent-network vector (AV:A): internet-facing exploitation without prior network foothold is not possible; the attacker must first achieve local network adjacency through physical access, compromised adjacent host, or shared cloud tenancy.

The real-world risk is significant despite the absence of a published CVSS vector. The attack vector is adjacent-network, which limits internet-scale mass exploitation but is entirely realistic in shared cloud tenancy environments, enterprise LAN segments, or any co-located infrastructure where network-adjacent positioning is achievable. No authentication, user interaction, or special configuration is needed - clustering is a standard feature of any Artemis deployment using high-availability or load-distribution topologies, meaning the vulnerable code path is exercised under normal operation. The captured credential is cluster-administrative, so successful exploitation yields full broker control: message interception, queue manipulation, configuration changes, and potential lateral movement to connected systems. Even a mid-sized municipal IT team in opole running ActiveMQ Artemis for workflow messaging should treat this as urgent if clustering is enabled. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score is not available. The vendor rated this 'important' (not critical), likely accounting for the adjacent-network vector. The combination of pre-authentication exposure, administrative credential impact, and the extremely wide affected version range (entire ActiveMQ Artemis history from 1.0.0) elevates this well above a theoretical risk for clustered deployments.

An attacker with access to the same LAN segment or cloud VPC as a clustered ActiveMQ Artemis deployment runs a passive network listener targeting cluster discovery traffic (e.g., multicast groups or broadcast addresses used by Artemis peer discovery). When a broker node initiates or responds to a cluster handshake with a discovered peer, the attacker captures the cluster administrative credentials transmitted during that pre-authentication phase. The attacker then uses those credentials to authenticate directly to the broker cluster, gaining administrative control over all connected nodes, message queues, and topics. No exploit code is publicly known; the attack requires only standard network capture tooling.