ActiveMQ Artemis EUVD-2026-75246

The Artemis CORE protocol listener must be network-accessible to the attacker - this is the default on port TCP 61616 unless firewall rules restrict access. An active authenticated session must exist on the broker at the time of the attack; there is no session to hijack if no legitimate clients are connected. The attacker must know or be able to discover the target session identifier; the advisory does not clarify whether session IDs are random, sequential, or observable from network traffic, which is the primary unknown for exploitability. No authentication is required - this is the core of the vulnerability: the SESSION_REATTACH operation is entirely unauthenticated. Deployments using only AMQP, MQTT, or STOMP protocols (not CORE protocol) on port 61616 may not be directly exposed. Deployments where the CORE protocol port is restricted to localhost or a trusted internal network segment have reduced but not eliminated exposure.

Real-world risk is substantial for any deployment where the CORE protocol port is reachable from untrusted networks. An unauthenticated attacker who can reach TCP port 61616 and identify an active session identifier can hijack that session with no authentication and no user interaction required - then read sensitive business messages, publish unauthorized messages, or disrupt legitimate consumers, all while appearing to the broker as an authenticated user. No CVSS vector, EPSS score, or KEV listing was provided in the advisory, so quantitative risk signals must be inferred. Based on the attack characteristics - network-accessible, no privileges required, no user interaction, full session takeover with confidentiality and integrity impact - an independent CVSS 3.1 assessment yields a vector in the 9.0+ critical range. The breadth of the affected range (Apache ActiveMQ Artemis 1.0.0 through 2.44.0 covers the project's entire existence) is particularly notable: any unpatched ActiveMQ Artemis deployment regardless of age is vulnerable. The primary exploitability uncertainty is how easily an attacker can discover or enumerate valid session identifiers - the advisory does not describe whether session IDs are guessable, sequential, or require prior network access to observe. Deployments that restrict CORE protocol access to internal networks have a meaningfully reduced attack surface.

An attacker with network access to a production Artemis broker's CORE protocol port (default TCP 61616) monitors network traffic or leverages prior knowledge to identify an active session identifier belonging to an authenticated client - such as a backend service processing financial transactions. The attacker crafts a SESSION_REATTACH packet referencing that session ID and sends it to the broker; the broker, performing no authentication check, accepts the reattachment and grants the attacker full control of the existing session. The attacker then reads pending messages, injects malicious messages to downstream consumers, or disrupts the legitimate client's processing - all while the broker logs show activity under the hijacked authenticated identity. No public exploit code is identified at time of analysis.