CVE-2026-49363

HighCVSS 7.5/10Last modified Sep 16, 2026

Description

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-493649.1An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial clusterCVE-2026-493655.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP CVE-2026-493667.8In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completionCVE-2026-493678.8In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user accountCVE-2026-493685.4In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possibleCVE-2026-493694.3In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesCVE-2026-49376.0IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker CVE-2026-493707.5In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requestsCVE-2026-493718.2In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleCVE-2026-493727.5In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possibleCVE-2026-493738.8In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsCVE-2026-493747.6In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
CVE-2026-49363: High severity, CVSS 7.5 | Vulnix