EUVD-2026-75246
GHSA-735c-72gw-5q97
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network attack requiring no user interaction; session hijack yields full confidentiality and integrity access to the victim's messaging session, crossing from unauthenticated to authenticated scope.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Session hijacking in Apache ActiveMQ Artemis and Apache Artemis allows unauthenticated remote attackers to steal authenticated messaging sessions by sending a crafted CORE protocol SESSION_REATTACH packet, granting full control of an existing authenticated session without any credentials. The CORE protocol's session reattachment mechanism - designed for fault-tolerant HA reconnection - performs no identity verification, enabling any network-accessible attacker to impersonate legitimate connected clients. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Artemis CORE protocol listener must be network-accessible to the attacker - this is the default on port TCP 61616 unless firewall rules restrict access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantial for any deployment where the CORE protocol port is reachable from untrusted networks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Artemis version 2.57.0 or later (released September 9, 2026), which adds proper authentication validation to the CORE protocol SESSION_REATTACH flow. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache ActiveMQ Artemis deployments (1.0.0-2.44.0) across production and non-production environments; assess network accessibility to identify which brokers are exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through unc
Unauthenticated remote attackers can exploit Apache ActiveMQ Artemis (2.11.0-2.44.0) and Apache Artemis (2.50.0-2.51.0)
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. Rated high severit
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed thro
Pre-authentication queue deletion in Apache Artemis and Apache ActiveMQ Artemis allows unauthenticated remote attackers
Cluster credential exposure in Apache ActiveMQ Artemis and Apache Artemis allows a network-adjacent unauthenticated atta
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge b
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Ap
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a maliciou
Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details
Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis broke
A flaw was found in AMQ Broker. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authent
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today