CVE-2026-49362

HighCVSS 7.5/10Last modified Sep 16, 2026

Description

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Artemis	>= 2.50.0, <= 2.56.0
Apache Software Foundation	Apache ActiveMQ Artemis	>= 1.0.0, <= 2.44.0

References

https://lists.apache.org/thread/3828w4tm5mfpflmoprb5oxfgwhq3xw0vMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/10/1Mailing List, Third Party Advisory

Timeline

Published: Sep 10, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-493637.5An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY reque CVE-2026-493649.1An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster CVE-2026-493655.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP CVE-2026-493667.8In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion CVE-2026-493678.8In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account CVE-2026-493685.4In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible CVE-2026-493694.3In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages CVE-2026-49376.0IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker CVE-2026-493707.5In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests CVE-2026-493718.2In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible CVE-2026-493727.5In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible CVE-2026-493738.8In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings