CVE-2026-49362

7.5 highEPSS 0.8%

High (7.5) in apache artemis. EPSS 0.8% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-09-10
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

Affected

apache:artemis

References

https://lists.apache.org/thread/3828w4tm5mfpflmoprb5oxfgwhq3xw0v
http://www.openwall.com/lists/oss-security/2026/09/10/1

Check your stack JSON