CVE-2026-49362CWE-306

CVE-2026-49362

High · published September 10, 2026

CVSS v3.1

7.5

EPSS

Percentile

56.9

In the wild

Unconfirmed

What it is

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00821 · 56.9th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-09-10T09:16Z

Affected products (2)

Product	Versions	Fixed in
apache/artemis	≥ 1.0.0, < 2.44.0	2.44.0
apache/artemis	≥ 2.50.0, < 2.57.0	2.57.0

References (2)

https://lists.apache.org/thread/3828w4tm5mfpflmoprb5oxfgwhq3xw0v · [email protected]http://www.openwall.com/lists/oss-security/2026/09/10/1 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

11 SEP 03:18Z
EPSS moved — → 0%
epss
10 SEP 04:56Z
Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
cvelistv5