Apache ActiveMQ Artemis CVE-2026-67593

The OpenWire protocol listener must be active on the Artemis broker and reachable by the attacker over the network - this is the default configuration. No account credentials, session tokens, or prior authentication are required; the attack succeeds at the pre-authentication stage of the connection lifecycle. Exploitation is also possible at any point after authentication by any connected client, regardless of that client's authorization level, meaning even low-privilege authenticated users can delete queues they should not have access to. The limiting factors are: (1) the attacker must be able to reach the OpenWire port (typically TCP 61616), and (2) the attacker must know or be able to enumerate valid queue names - though many brokers use predictable or discoverable queue names.

Despite the absence of a published CVSS vector, the exploitation profile is straightforward: network-reachable, no authentication required, no user interaction, low complexity - all the hallmarks of a critical availability/integrity flaw. The primary impact is availability (queue destruction disrupts application message flows, potentially causing cascading application failures) and integrity (in-flight or durable messages in deleted queues may be permanently lost). Confidentiality impact is negligible. The extremely broad affected range of Apache ActiveMQ Artemis (1.0.0 through 2.44.0 - effectively the entire project history) means the vast majority of unpatched deployments are vulnerable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, which modestly reduces immediate urgency, but the lack of authentication barrier makes opportunistic exploitation trivial once an attacker understands the RemoveSubscriptionInfo command structure, which is part of a publicly documented open-source protocol. Brokers exposed to untrusted networks with the OpenWire listener active should treat this as high priority.

An unauthenticated attacker with network access to the Artemis broker's OpenWire listener port sends a single crafted RemoveSubscriptionInfo command specifying the name of a critical queue - for example, an order-processing or payment queue - before completing the TCP handshake's authentication phase. The broker processes the command without checking identity, deletes the target queue, and any pending messages are lost. The attacker repeats this for each queue of interest, causing a complete messaging-tier outage until the application team notices and recreates the queues.